CVE entry · CVE-2025-59718
CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
- Actively exploited: added to CISA’s KEV catalog on December 16, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: December 23, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes affected Fortinet products, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (fortiguard.fortinet.com)
- Vendor advisory or reference cited by CISA (docs.fortinet.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Fortinet vulnerabilities
-
Fortinet Multiple Products Path Traversal Vulnerability
-
Fortinet FortiMail Path Traversal Vulnerability
-
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
-
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
-
Fortinet FortiSandbox OS Command Injection Vulnerability
-
Fortinet FortiSandbox OS Command Injection Vulnerability