Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-59718

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

9.8
CVSS 3.1
2
stories
DEC 16
added to KEV
Severity
9.8 Critical · vendor score
Vendor
Fortinet
Product
Multiple Products
Published
Dec 9, 2025
Added to KEV
Dec 16, 2025
KEV deadline
Dec 23, 2025
Ransomware use
Unknown
Weakness
CWE-347
Part of FortiCloud SSO Authentication Bypass →

What it is

Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. IntrusionsFortinet FortiGate Devices Targeted in New CampaignThis activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-2025-59718 and CVE-2025-59719).DENNIS FISHER · 3 MIN
  2. VulnerabilitiesFortinet Warns of Critical Flaw After FortiCloud SSO ExploitationFortinet is rolling out updates for CVE-2026-24858, with fixes for some versions available as of Tuesday, and others in releases that are upcoming at an unspecified date.DECIPHER · 2 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryfortiguard.fortinet.com/psirt/FG-IR-25-647Analysisarcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719Analysiscert-portal.siemens.com/productcert/html/ssa-864900.html