CVE-2025-59718
Published 2025-12-09 · Updated 2026-06-17 · Source psirt@fortinet.com
Summary
CVE-2025-59718 is a critical-severity (CVSS 9.8) vulnerability in Fortinet Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on December 16, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 23, 2025. CISA does not currently list it as used in ransomware campaigns. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.
All 32 known-exploited Fortinet vulnerabilities →Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Fortinet — Multiple Products
Name: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Date added: 2025-12-16 · Due: 2025-12-23
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-647
- https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/
- https://cert-portal.siemens.com/productcert/html/ssa-864900.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718