Summary
CVE-2025-59718 is a critical improper verification of cryptographic signature vulnerability (CWE-347) in Fortinet FortiOS, FortiProxy, and FortiSwitchManager, carrying a CVSS 3.1 base score of 9.8. An unauthenticated remote attacker can bypass FortiCloud SSO login authentication by sending a crafted SAML response, potentially gaining administrative access to affected network security appliances. This vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on December 16, 2025, and active exploitation in the wild has been confirmed.
Technical details
- Root cause: The affected products fail to properly verify the cryptographic signature of SAML response messages (CWE-347) during FortiCloud SSO authentication processing.
- Trigger conditions: The FortiCloud SSO login feature must be enabled on the device. While not enabled in default factory settings, it is automatically enabled when an administrator registers the device to FortiCare via the GUI — unless the "Allow administrative login using FortiCloud SSO" toggle is explicitly disabled.
- Attack mechanism: An attacker sends a crafted SAMLResponse to the
/remote/saml/loginendpoint, asserting a privileged identity from a trusted issuer (e.g.,https://sso.forticloud.com). Because the system does not properly validate the SAML assertion’s cryptographic signature, the forged response is accepted and the attacker is logged in without valid credentials. - Attack vector: Network-accessible, no authentication required, no user interaction required (AV:N/AC:L/PR:N/UI:N).
- Impact: Successful exploitation grants an unauthenticated attacker full administrative access to the affected appliance, with high impact to confidentiality, integrity, and availability.
- Exploitation status: Actively exploited in the wild. CISA added CVE-2025-59718 to its KEV catalog on December 16, 2025. Public proof-of-concept code is available. Reports indicate exploitation of patch bypasses following initial remediation.
Affected software
- FortiOS 7.6.0 through 7.6.3
- FortiOS 7.4.0 through 7.4.8
- FortiOS 7.2.0 through 7.2.11
- FortiOS 7.0.0 through 7.0.17
- FortiProxy 7.6.0 through 7.6.3
- FortiProxy 7.4.0 through 7.4.10
- FortiProxy 7.2.0 through 7.2.14
- FortiProxy 7.0.0 through 7.0.21
- FortiSwitchManager 7.2.0 through 7.2.6
- FortiSwitchManager 7.0.0 through 7.0.5
Severity
CVSS 3.1 Base Score: 9.8 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate — apply patches:
- FortiOS: upgrade to 7.6.4, 7.4.9, 7.2.12, or 7.0.18 (or later within each branch)
- FortiProxy: upgrade to 7.6.4, 7.4.11, 7.2.15, or 7.0.22 (or later within each branch)
- FortiSwitchManager: upgrade to 7.2.7 or 7.0.6 (or later within each branch)
- If immediate patching is not feasible: Disable the "Allow administrative login using FortiCloud SSO" option on affected devices to remove the attack surface until the patch can be applied. Refer to the Fortinet advisory (FG-IR-25-647) for full guidance.
- Network mitigation: Restrict management interface access to trusted networks and IP ranges; do not expose administrative interfaces to the public internet.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.