CVE-2025-59719: Fortinet Multiple Products FortiCloud SSO auth bypass via SAML signature flaw

CVE-2025-59719 · Severity: critical · CVSS 9.8 · Published 2025-12-09

A vulnerability in several Fortinet networking and security products could allow an unauthorized person to bypass login protections and gain administrative access. This occurs when the FortiCloud Single Sign-On (SSO) feature is enabled, allowing an attacker to spoof a login response. If exploited, an attacker could take full control of the device, potentially leading to data theft, network disruption, or further attacks on the corporate environment.

Technologies: Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, Fortinet FortiWeb. Vendors: Fortinet.

Quick answers

Is CVE-2025-59719 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59719 being exploited in the wild.
How severe is CVE-2025-59719?
Critical severity, with a CVSS score of 9.8, published 9 December 2025.
Which products and versions are affected?
Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17; Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, 7.0.0 through 7.0.21; Fortinet FortiSwitchManager 7.2.0 through 7.2.6, 7.0.0 through 7.0.5; Fortinet FortiWeb 8.0.0, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9.
Is there a fix for CVE-2025-59719?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59719 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-59719?
Check whether you run Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper verification of cryptographic signature vulnerability (CWE-347) exists in the GUI component of FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. The flaw allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted SAML response message to the FortiCloud SSO login endpoint. This vulnerability is only exploitable if the 'Allow administrative login using FortiCloud SSO' feature is enabled, which is often toggled on during device registration to FortiCare. Successful exploitation grants the attacker administrative access to the device management interface. Patches are available for all affected product lines, and a workaround exists to disable the FortiCloud SSO login feature via the CLI or GUI.

Affected products

  • Fortinet FortiWeb 8.0.0, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9
  • Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17
  • Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, 7.0.0 through 7.0.21
  • Fortinet FortiSwitchManager 7.2.0 through 7.2.6, 7.0.0 through 7.0.5

Timeline

  • 2025-12-09: disclosed: Initial publication by Fortinet
  • 2025-12-09: advisory: Fortinet PSIRT FG-IR-25-647 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.