CVE-2025-59718

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-59718 9.8

Fortinet · Multiple Products · Added 2025-12-16 · Published 2025-12-09

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

VendorFortinet

ProductMultiple Products

Date added2025-12-16

Due date2025-12-23

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-347

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

NVD: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-29 09:44 UTC

Searches4

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-59718
https://www.fortiguard.com/psirt/FG-IR-25-647
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://github.com/exfil0/CVE-2025-59718-PoC
https://github.com/exfil0/CVE-2025-59718-PoC/blob/main/README.md
https://github.com/exfil0/CVE-2025-59718-PoC/blob/main/exploit.py
https://github.com/moften/CVE-2025-59718-Fortinet-Poc
https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-fortinet-cve-2025-59718-cve-2025-59719-exploited-in-the-wild/
https://www.opswat.com/blog/technical-analysis-of-forticloud-sso-authentication-bypass-cve-2025-59718-cve-2025-59719
https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-on-fortigate-devices-following-disclosure-of-cve-2025-59718-and-cve-2025-59719/
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
https://www.bleepingcomputer.com/news/security/hackers-exploit-newly-patched-fortinet-auth-bypass-flaws/

Hunting hypothesis agent

Hunt HTTPS logs for POST to /remote/saml/login with an unsigned SAMLResponse (no ds:Signature) containing Issuer sso.forticloud.com and super_admin role; success redirects to the FortiGate admin dashboard.

Research details

ComponentFortiCloud SSO SAML authentication module (SAML response signature verification at /remote/saml/login)

PreconditionsThe target Fortinet device must be running an affected version: FortiOS 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8, 7.6.0-7.6.3; FortiProxy 7.0.0-7.0.21, 7.2.0-7.2.14, 7.4.0-7.4.10, 7.6.0-7.6.3; FortiSwitchManager 7.0.0-7.0.5, 7.2.0-7.2.6. The FortiCloud SSO login feature must be enabled (not enabled by default in factory settings, but becomes enabled when an administrator registers the device to FortiCare via the GUI unless the 'Allow administrative login using FortiCloud SSO' toggle is explicitly disabled). The attacker must have network access to the device's HTTPS management interface (typically TCP/443). The attacker crafts an unsigned SAML response and POSTs it to /remote/saml/login with SAMLResponse and RelayState form fields; the device accepts the forged assertion without verifying the XML signature and issues an administrative session cookie (super_admin profile). No authentication credentials or user interaction are required. agent

DeliveryAn attacker POSTs a base64-encoded, unsigned SAML Response to https://<target>/remote/saml/login with Content-Type application/x-www-form-urlencoded containing SAMLResponse=<forged_token>&RelayState=. The SAML Response declares Issuer=https://sso.forticloud.com, sets SubjectNameID to <username>@forticloud.com, includes a Role attribute with value super_admin, and omits any XML Signature element. The device accepts it without verification and redirects to the admin dashboard with a valid session cookie.

Public PoCyes

PoC URLs https://github.com/exfil0/CVE-2025-59718-PoC
https://github.com/moften/CVE-2025-59718-Fortinet-Poc Third-party repos; verify before use.

Advisoryhttps://www.fortiguard.com/psirt/FG-IR-25-647

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). The exfil0 PoC (exploit.py) generates a fully unsigned SAML Response with Issuer=https://sso.forticloud.com, a SubjectNameID of <username>@forticloud.com, and a super_admin role attribute, then POSTs it as base64-encoded SAMLResponse to /remote/saml/login. Success is indicated by HTTP 200/302 with response body containing 'dashboard', 'fortios', or 'fortiproxy'. Post-auth: attacker accesses /api/v2/monitor/system/config/backup?scope=global to download device configuration including secrets. The moften PoC is a detection-only scanner (passive fingerprinting, version check, SSO enablement check) that does not weaponize the exploit. Multiple public PoCs exist but only the exfil0 repo contains a working exploit script. Actively exploited in the wild since December 2025 by multiple threat actors. Arctic Wolf observed malicious SSO logins on FortiGate devices following disclosure.

SummaryCVE-2025-59718 is an improper verification of cryptographic signature vulnerability (CWE-347) in Fortinet FortiOS, FortiProxy, and FortiSwitchManager that allows unauthenticated remote attackers to bypass FortiCloud SSO login authentication by sending a crafted, unsigned SAML response. The vulnerability exists because the SAML assertion consumer endpoint (/remote/saml/login) does not verify the XML digital signature on incoming SAML responses. The exfil0 PoC demonstrates the full attack: forge an unsigned SAML Response with issuer https://sso.forticloud.com, set the username attribute to the target admin, assign the super_admin role, POST it to /remote/saml/login, and receive an authenticated admin session. Post-exploitation includes downloading device configuration via /api/v2/monitor/system/config/backup. Multiple public exploits exist; the vulnerability is actively exploited in the wild. Related CVE-2025-59719 affects the same issue on FortiWeb. Patches are available in FortiOS 7.4.9+, FortiProxy 7.4.11+, and other fixed versions per FG-IR-25-647.

Tia coverage

First reported2026-06-18

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.