{"id":"CVE-2025-59718","published":"2025-12-09T18:15:54Z","modified":"2026-06-17T09:46:35Z","title":"Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability","vendor":"Fortinet","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper verification of cryptographic signatures in Fortinet's Multiple Products, affecting FortiOS, FortiProxy and FortiSwitchManager across the listed 7.x version ranges. An unauthenticated remote attacker can bypass FortiCloud SSO login authentication by sending a crafted SAML response message, requiring no credentials, no user interaction, and only network access to the affected device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:00Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.68293,"percentile":0.99329,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-12-16","dueDate":"2025-12-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-25-647 ; https://docs.fortinet.com/upgrade-tool/fortigate ; https://nvd.nist.gov/vuln/detail/CVE-2025-59718","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-12-15","exploitedFirstSeen":"2025-12-15","ransomware":true,"evidence":[{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/","date":"2025-12-15"},{"url":"https://www.linkedin.com/posts/simokohonen_fortinet-under-attack-again-cve-2025-59718-activity-7406035983651266561-6tHB/","date":"2025-12-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-12-16"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-59718","date":"2025-12-17"},{"url":"https://www.linkedin.com/posts/drayagha_for-the-latest-fortigate-cves-cve-2025-59718-activity-7407214356226281473-K0vf/","date":"2025-12-17"},{"url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-fortinet-cve-2025-59718-cve-2025-59719-exploited-in-the-wild/","date":"2025-12-17"},{"url":"https://blog.talosintelligence.com/adios-2025-you-wont-be-missed/","date":"2025-12-18"},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2025-59718","date":"2025-12-19"},{"url":"https://www.recordedfuture.com/blog/december-2025-cve-landscape","date":"2026-01-13"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-647","tags":["Vendor Advisory"]},{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-864900.html","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated attacker exploits public-facing login via SAML","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication","start":405,"end":489}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: bypassed login yields valid account access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication","start":405,"end":489}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-202198","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202198","exploited":true,"exploitedSince":"2025-12-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-12-17","earliestUrl":"https://github.com/exfil0/CVE-2025-59718-PoC","repos":[{"name":"exfil0/CVE-2025-59718-PoC","url":"https://github.com/exfil0/CVE-2025-59718-PoC","stars":6,"created":"2025-12-17"},{"name":"moften/CVE-2025-59718-Fortinet-Poc","url":"https://github.com/moften/CVE-2025-59718-Fortinet-Poc","stars":3,"created":"2025-12-27"}]},"first":{"date":"2025-12-17","source":"PoC-in-GitHub","url":"https://github.com/exfil0/CVE-2025-59718-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2025-12-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59718","provenance":"source"},{"date":"2025-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/","provenance":"source"},{"date":"2025-12-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-12-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202198","provenance":"source"},{"date":"2025-12-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/exfil0/CVE-2025-59718-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":7},"priority":{"score":84.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 319 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9933"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}