CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature
An unauthenticated attacker can bypass FortiCloud SSO login authentication by sending a crafted SAML response, gaining unauthorized access to Fortinet devices.
- Exploited in the wild
- Since 16 Dec 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59718?
CVE-2025-59718 is a critical authentication bypass vulnerability in Fortinet Fortios, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Weakness: CWE-347
Which versions are affected by CVE-2025-59718?
It affects 4 products.
Products include Fortinet Fortios, Fortinet Fortiproxy, Fortinet Fortiswitchmanager, Siemens Ruggedcom Ape1808 Firmware.
How do I fix CVE-2025-59718?
No fix has been published for CVE-2025-59718 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Dec 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-59718 being exploited?
Yes. Attackers have exploited CVE-2025-59718 in the wild since at least 16 Dec 2025.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Fortinet Fortios
Sources
Also known as GHSA-fjj2-p33c-f8qq.