CVE-2025-59718

What it actually does

The vulnerability is an unauthenticated SAML single sign-on authentication bypass caused by improper verification of cryptographic signatures in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. A network-reachable attacker can submit a crafted SAML response to the FortiCloud SSO authentication flow and have it accepted as valid, allowing the attacker to impersonate a legitimate user without credentials. Because these products commonly protect network perimeter, proxy, switching, VPN, and administrative control planes, successful exploitation can provide high-impact administrative access, configuration control, traffic interception opportunities, and a foothold for broader intrusion activity.

Why it matters to the business

This is a critical, actively exploited authentication bypass affecting widely deployed Fortinet infrastructure products and is listed in CISA KEV with a remediation due date of 2025-12-23, making unremediated systems high-priority risk. Compromise can lead to unauthorized administrator access, network policy changes, VPN or proxy abuse, exposure of sensitive configuration data, service disruption, and use of edge devices as persistent entry points into the organization. The high EPSS score indicates a materially elevated likelihood of exploitation, and affected downstream appliances such as Siemens RUGGEDCOM APE1808 deployments may extend exposure beyond directly managed Fortinet-branded assets.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable FortiOS, FortiProxy, or FortiSwitchManager management interface that supports FortiCloud SSO/SAML authentication and is running an affected version. The attacker then crafts a SAML response message that abuses the product's improper cryptographic signature verification, causing the appliance to trust an assertion that should be rejected. If accepted, the attacker is logged in as a chosen or privileged identity without knowing that user's password or completing normal authentication. After gaining access, the attacker can create or modify administrator accounts, export or alter configuration, change firewall/proxy/VPN policies, inspect sensitive settings, establish persistence, and use the appliance as a launch point for lateral movement. Reported in-the-wild activity is associated with FortiGate authentication bypass exploitation campaigns involving this vulnerability and related Fortinet issues, so defenders should assume exposed vulnerable systems may be targeted quickly and repeatedly.

How to fix it

Upgrade affected Fortinet products to vendor-released fixed versions or the latest available maintenance release that explicitly remediates this vulnerability. No exact fixed versions were provided in the input, so administrators should consult Fortinet PSIRT advisories and product release notes for FortiOS, FortiProxy, and FortiSwitchManager before selecting the target build. Prioritize all internet-facing management interfaces, VPN-adjacent appliances, FortiCloud SSO-enabled systems, and Siemens RUGGEDCOM APE1808 deployments that include affected Fortinet components. Until upgrades are complete, restrict administrative management access to trusted administrative networks or VPNs, disable or limit FortiCloud SSO/SAML where operationally feasible, enforce local administrative MFA where available, remove unnecessary management exposure from the internet, and monitor for unexpected SSO logins or configuration changes. After remediation, rotate administrative credentials and API keys, review all administrator accounts, verify trusted SAML/SSO configuration, and compare current configuration against a known-good baseline.

How to confirm the fix worked

Confirm exposure by inventorying all FortiOS, FortiProxy, FortiSwitchManager, and downstream appliances and comparing running versions against the affected ranges. Validate that each device is upgraded to a Fortinet build that explicitly lists this vulnerability as fixed. Confirm that administrative interfaces are not exposed to untrusted networks and that any SAML/FortiCloud SSO configuration is intentional, current, and restricted. Review system event logs and FortiAnalyzer records for successful SAML or FortiCloud SSO logins before and after remediation, especially from unusual source IPs or accounts. Confirm no unauthorized administrator accounts, API tokens, local users, VPN users, policy changes, routing changes, proxy policy changes, certificate changes, or configuration exports occurred during the exposure window. If possible, use a safe vendor-supported assessment or authenticated version check rather than exploit testing against production systems.

Typical attack path

1. Scan for Fortinet FortiOS, FortiProxy, FortiSwitchManager, or downstream appliances exposing management or SSO-related endpoints.
2. Fingerprint the product and version to identify systems within affected FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17; FortiProxy 7.6.0-7.6.3, 7.4.0-7.4.10, 7.2.0-7.2.14, 7.0.0-7.0.21; or FortiSwitchManager 7.2.0-7.2.6, 7.0.0-7.0.5 ranges.
3. Determine whether FortiCloud SSO/SAML login is enabled or reachable.
4. Send a crafted SAML response that bypasses signature validation.
5. Obtain an authenticated administrative session without valid credentials.
6. Create or modify administrator accounts, API access, VPN/proxy/firewall policies, or other configuration to maintain access.
7. Export configuration, enumerate users and secrets, or pivot into internal services reachable from the appliance.
8. Delete or minimize logs and blend subsequent activity into normal administrative traffic.

How to detect it

Investigate Fortinet system event logs, administrative audit logs, FortiAnalyzer records, FortiCloud/SSO logs, identity provider SAML logs, web management access logs, configuration revision history, VPN/proxy/firewall policy change logs, and network telemetry to determine whether exploitation already occurred. Focus on successful FortiCloud SSO or SAML administrative logins from unusual IP addresses, countries, user agents, times, or accounts; SAML login success without a corresponding valid identity provider event; signature validation errors followed by successful login; sudden new administrator accounts; privilege changes; API key or token creation; configuration export/download; firmware or certificate changes; policy/routing/VPN/proxy changes; and log clearing or gaps. Correlate management-plane HTTP requests containing SAMLResponse parameters with successful administrative sessions. For affected systems, assume the relevant exposure window begins when the vulnerable version was deployed or when FortiCloud SSO/SAML became reachable, whichever is later. If Fortinet logs are limited, rely on upstream reverse proxy, firewall, NetFlow, packet capture, identity provider, and SIEM data to identify suspicious SSO requests and post-authentication administrative activity.

• SAMLResponse=
• FortiCloud SSO
• FortiCloud
• SAML
• saml
• signature validation
• invalid signature
• Administrator logged in successfully
• logged in successfully from https
• Administrator login failed
• action=login
• status=success
• subtype=system
• ui=https
• config changed
• configuration changed
• cfg-save
• cfg-download
• backup config
• new administrator
• admin account
• api-user
• api key
• trusted hosts
• /remote/saml
• /saml
• /saml/acs
• /sso
• /logincheck
• /api/v2/cmdb/system/admin
• /api/v2/monitor/system/config/backup

What your security team should do

• Treat this as an emergency remediation item because it is critical, remotely exploitable without credentials, KEV-listed, and actively exploited in the wild.
• Identify all affected Fortinet and downstream Siemens RUGGEDCOM APE1808 assets, including appliances not directly internet-facing but reachable from partner, management, or VPN networks.
• Patch or upgrade affected products to Fortinet-confirmed fixed releases; if fixed builds are unavailable for a platform, apply compensating controls immediately and pursue vendor guidance or replacement.
• Immediately restrict management interfaces and SSO endpoints to trusted administrative networks only; remove public internet exposure wherever possible.
• Temporarily disable FortiCloud SSO/SAML authentication on affected systems if business operations allow until the device is remediated.
• Hunt for prior exploitation across FortiGate/FortiOS, FortiProxy, FortiSwitchManager, FortiAnalyzer, SSO provider, firewall, VPN, proxy, and EDR telemetry.
• Review all administrator accounts, API keys, access tokens, SSO configuration, certificates, firewall/proxy/VPN policies, and configuration revisions for unauthorized changes.
• Rotate administrative credentials and revoke suspicious sessions or tokens after patching and validation.
• Preserve logs and configuration snapshots from the full exposure window for incident response review.
• Because the KEV remediation date of 2025-12-23 has passed based on the provided data, escalate any remaining vulnerable internet-facing systems as overdue critical risk.