CVE-2025-59718: Fortinet FortiOS/FortiProxy SAML signature check bypass in FortiCloud SSO

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with a near-term due date, high EPSS and reported in-the-wild SSO logins make this an urgent authentication bypass.

What it is

FortiOS, FortiProxy and FortiSwitchManager fail to properly verify the cryptographic signature of SAML responses used for FortiCloud SSO login. An unauthenticated remote attacker can forge a SAML response and bypass authentication entirely. The flaw affects a wide range of FortiOS, FortiProxy and FortiSwitchManager releases and is listed in CISA KEV, so it warrants urgent attention.

Impact

An attacker gains authenticated access to the management interface without valid credentials, with high impact to confidentiality, integrity and availability per the CVSS vector. This can lead to full administrative control of the affected device.

Attack surface

Reachable over the network via the FortiCloud SSO login flow; the CVSS vector shows no privileges and no user interaction required. Any internet-exposed management interface using FortiCloud SSO is a candidate target.

Exploitation

CVE-2025-59718 is in CISA KEV with a due date of 2025-12-23, and EPSS is 0.68 (99th percentile), indicating active exploitation is expected or observed. A third-party advisory reports malicious SSO logins following disclosure.

What to do

• Apply the Fortinet vendor patches referenced in FG-IR-25-647 for all affected FortiOS, FortiProxy and FortiSwitchManager versions.
• If patching is not immediately possible, disable FortiCloud SSO authentication on management interfaces or restrict management access to trusted networks.
• Follow CISA BOD 22-01 guidance for cloud services and the KEV required action, including discontinuing use if mitigations are unavailable.
• Review Siemens advisory SSA-864900 for any Ruggedcom AP1808 exposure and apply the corresponding fix.
• Audit and rotate administrative credentials and sessions on devices that may have been exposed.

Detection

• Search authentication logs for successful FortiCloud SSO logins from unexpected source IPs or at unusual times.
• Alert on SAML responses with invalid or missing signatures reaching the SSO endpoint.
• Monitor for new or changed admin accounts and configuration changes on FortiOS, FortiProxy and FortiSwitchManager devices.
• Correlate management-plane logins with threat intelligence for known exploitation activity following the December 2025 disclosure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.