CVE-2025-59718

09.12.2025, 18:15

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet	CNA	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vendor	Product	Version
fortinet	fortiproxy	7.0.0 ≤ 𝑥 ≤ 7.0.21
fortinet	fortiproxy	7.2.0 ≤ 𝑥 ≤ 7.2.14
fortinet	fortiproxy	7.4.0 ≤ 𝑥 ≤ 7.4.10
fortinet	fortiproxy	7.6.0 ≤ 𝑥 ≤ 7.6.3
fortinet	fortiswitchmanager	7.0.0 ≤ 𝑥 ≤ 7.0.5
fortinet	fortiswitchmanager	7.2.0 ≤ 𝑥 ≤ 7.2.6
fortinet	fortios	7.0.0 ≤ 𝑥 ≤ 7.0.17
fortinet	fortios	7.2.0 ≤ 𝑥 ≤ 7.2.11
fortinet	fortios	7.4.0 ≤ 𝑥 ≤ 7.4.8
fortinet	fortios	7.6.0 ≤ 𝑥 ≤ 7.6.3

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-347 - Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-647