What is the CVSS score of CVE-2025-59718?

CVE-2025-59718 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 9.5%.

Which versions of Fortinet FortiOS are affected by CVE-2025-59718?

Fortinet's SSO authentication layer (FortiOS, FortiProxy, FortiSwitchManager) is vulnerable to spoofing by unauthenticated attackers, creating imminent risk of unauthorized administrative access.

Is CVE-2025-59718 being actively exploited?

Yes, CVE-2025-59718 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-59718?

Within 24 hours: Inventory all Fortinet FortiOS, FortiProxy, and FortiSwitchManager instances with FortiCloud SSO enabled; enable detailed SAML authentication logging and real-time alerting. Within 7 days: Restrict FortiCloud SSO access to allowlisted source IP addresses only; enforce multi-factor authentication (MFA) on all FortiCloud administrative accounts; implement network segmentation to isolate management planes from operational networks. Within 30 days: Monitor Fortinet security advisories for patch availability (check daily); prepare emergency patch deployment procedures; escalate vendor for timeline commitment on CVE-2025-59718 fix.

Fortinet FortiOS CVE-2025-59718

CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2025-12-09 psirt@fortinet.com

Fortinet Authentication Bypass Jwt Attack

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:32 vuln.today

Added to CISA KEV

Jun 09, 2026 - 10:31 CISA

CVE Published

Dec 09, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

AnalysisAI

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to defeat FortiCloud SSO login by submitting a crafted SAML response, due to improper verification of the response's cryptographic signature. The flaw is confirmed actively exploited (CISA KEV), with Arctic Wolf observing malicious SSO logins in the wild, and EPSS rates it at the 93rd percentile of likelihood. Combined with a 9.8 CVSS score and CWE-347 root cause, this is a top-priority patching target for any organization running affected Fortinet management planes.

Technical ContextAI

The vulnerability lives in the SAML-based FortiCloud Single Sign-On flow used by FortiOS, FortiProxy, and FortiSwitchManager management interfaces. CWE-347 (Improper Verification of Cryptographic Signature) indicates the service processes SAML assertions without correctly validating the issuer's signature - common implementation defects in this class include accepting unsigned assertions, honoring attacker-chosen signing keys, mishandling XML canonicalization, or failing signature validation while still consuming the asserted identity. SAML responses carry the authenticated subject and group claims, so a forged or tampered assertion lets the attacker impersonate any FortiCloud-linked identity. The 'Jwt Attack' tag from the intelligence feed suggests token-level forgery techniques (such as algorithm confusion or key substitution) are involved in observed exploitation.

RemediationAI

Patch available per vendor advisory - apply the fixed builds documented in Fortinet PSIRT FG-IR-25-647 (https://fortiguard.fortinet.com/psirt/FG-IR-25-647) for each affected branch of FortiOS, FortiProxy, and FortiSwitchManager; consult the advisory for the exact target build per release train rather than relying on third-party version claims. Until patching is complete, disable FortiCloud SSO on management interfaces and revert to local administrator authentication, which removes the vulnerable SAML code path at the cost of breaking centralized identity workflows. Additionally restrict administrative interface exposure to a management VLAN or trusted-IP allowlist (trunk-link only) so unauthenticated internet attackers cannot reach the SAML endpoint, accepting that this complicates legitimate remote admin access. Review SSO and admin login logs for suspicious authentications consistent with Arctic Wolf's observations (https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/) and rotate administrative credentials and API tokens on any device that was internet-exposed before patching. Confirm KEV due-date compliance via the CISA catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718.