What is the CVSS score of CVE-2025-59719?

CVE-2025-59719 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fortinet FortiWeb are affected by CVE-2025-59719?

FortiWeb authentication controls protecting enterprise applications have been undermined by a critical vulnerability affecting versions 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9, exposing organizations to…

How to fix or mitigate CVE-2025-59719?

Within 24 hours: Identify all FortiWeb deployments and document affected versions (8.0.0, 7.6.0-7.6.4, 7.4.0-7.4.9); query authentication logs for anomalous SAML assertions or unexpected sign-on successes. Within 7 days: Implement network segmentation and access controls restricting FortiWeb exposure; enable detailed logging and alerting on SAML transaction anomalies; evaluate disabling FortiCloud SSO in favor of alternative identity providers if operationally feasible. Within 30 days: Monitor Fortinet security advisories for patch availability and upgrade planning; conduct testing on patched versions immediately upon release; implement enhanced authentication monitoring across all protected applications.

Fortinet FortiWeb CVE-2025-59719

CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2025-12-09 psirt@fortinet.com

Fortinet Authentication Bypass Jwt Attack Fortiweb

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:32 vuln.today

CVE Published

Dec 09, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

AnalysisAI

Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers to circumvent FortiCloud SSO login by sending a crafted SAML response message. The flaw stems from improper cryptographic signature verification (CWE-347), enabling forgery of authentication assertions. No public exploit identified at time of analysis, EPSS sits at 0.26% (50th percentile), and the issue is not currently listed in CISA KEV, though Fortinet products have historically been high-value targets.

Technical ContextAI

FortiWeb is Fortinet's web application firewall product, which integrates with FortiCloud single sign-on using SAML (Security Assertion Markup Language) for federated authentication. SAML relies on XML digital signatures to verify that authentication assertions come from a trusted Identity Provider. CWE-347 (Improper Verification of Cryptographic Signature) indicates the SAML response signature validation logic is flawed - likely failing to properly validate the signature, accepting unsigned assertions, or being susceptible to XML signature wrapping (XSW) attacks. The CPE data confirms the issue spans the fortiweb product across multiple branches (7.4.x, 7.6.x, and 8.0.0), pointing to a shared SSO/SAML library or component.

RemediationAI

Patch available per vendor advisory FG-IR-25-647 (https://fortiguard.fortinet.com/psirt/FG-IR-25-647) - exact fixed versions should be confirmed directly from that advisory, as the input data does not enumerate them. Administrators running 7.4.x should upgrade beyond 7.4.9, those on 7.6.x beyond 7.6.4, and 8.0.0 deployments should move to the next vendor-released maintenance build. As a compensating control while patching, disable FortiCloud SSO login on the management interface and revert to local administrator authentication (trade-off: loss of centralized SSO convenience and any conditional access policies tied to it). Additionally, restrict network access to the FortiWeb management interface to a dedicated management VLAN or jump-host range via firewall ACLs, which limits exposure of the vulnerable SAML endpoint to untrusted networks. Siemens-environment operators should also consult SSA-864900 for any vendor-specific guidance.