• CVE-2025-59718: This vulnerability involves improper verification of cryptographic signatures in versions of Fortinet FortiOS, FortiProxy, and FortiSwitchManager, which could allow an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response message.
• CVE-2025-59719: This vulnerability involves improper verification of cryptographic signatures in Fortinet FortiWeb, which could allow an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response message.

Read more

Affected Versions

FortiOS: 7.0.0–7.0.17, 7.2.0–7.2.11, 7.4.0–7.4.8, 7.6.0–7.6.3
FortiProxy: 7.0.0–7.0.21, 7.2.0–7.2.14, 7.4.0–7.4.10, 7.6.0–7.6.3
FortiSwitchManager: 7.0.0–7.0.5, 7.2.0–7.2.6
FortiWeb: 7.4.0–7.4.9, 7.6.0–7.6.4, 8.0.0

How attackers exploit this vulnerability (attack vector)

• Full administrative compromise of Fortinet devices
• Configuration changes, creation of new admin accounts, or disabling of security controls
• Lateral movement deeper into the corporate network

CERTVU recommend:

• Apply Fortinet’s latest patches immediately for all affected products.
• Disable FortiCloud SSO login on devices until patched.
• Audit devices for signs of unauthorized access, new accounts, or unexpected configuration changes.
• Restrict management interface exposure to trusted IPs or VPN-only access.
• Consult the Fortinet Product Security Advisory for detailed update and mitigation information.