CVE-2025-59718: Fortinet FortiProxy Auth Bypass Vulnerability

CVE-2025-59718 Overview

CVE-2025-59718 is a critical improper verification of cryptographic signature vulnerability affecting multiple Fortinet products including FortiOS, FortiProxy, and FortiSwitchManager. This authentication bypass vulnerability allows unauthenticated remote attackers to bypass FortiCloud SSO login authentication by crafting malicious SAML response messages that exploit weaknesses in the cryptographic signature verification process.

The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), which indicates a fundamental flaw in how the affected products validate SAML assertions. This type of vulnerability is particularly dangerous as it targets the core authentication mechanism of enterprise security infrastructure.

Critical Impact

This vulnerability is actively being exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated attackers can completely bypass SSO authentication to gain unauthorized access to Fortinet management interfaces.

Affected Products

• Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.17
• Fortinet FortiProxy versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, and 7.0.0 through 7.0.21
• Fortinet FortiSwitchManager versions 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5

Discovery Timeline

• 2025-12-09 - CVE-2025-59718 published to NVD
• 2025-12-17 - Last updated in NVD database

Technical Details for CVE-2025-59718

Vulnerability Analysis

This vulnerability stems from improper verification of cryptographic signatures in SAML (Security Assertion Markup Language) response processing within FortiCloud SSO authentication workflows. SAML is widely used for single sign-on (SSO) authentication across enterprise environments, making this vulnerability particularly impactful for organizations relying on centralized identity management.

The flaw allows attackers to craft malicious SAML response messages that bypass signature validation checks. When the affected Fortinet products receive these crafted responses, they fail to properly verify the cryptographic signature, accepting the malicious assertion as legitimate. This enables attackers to assume the identity of any user without possessing valid credentials.

The vulnerability affects network-accessible authentication endpoints and requires no prior authentication or user interaction to exploit, making it highly accessible to remote attackers. The potential impact includes complete compromise of confidentiality, integrity, and availability of the affected systems.

Root Cause

The root cause is improper implementation of cryptographic signature verification in the SAML response handling code. When processing SAML assertions, the affected Fortinet products fail to adequately validate that the cryptographic signature corresponds to the expected identity provider and that the signature covers all relevant portions of the assertion. This allows attackers to manipulate SAML responses in ways that bypass authentication controls.

Attack Vector

The attack vector is network-based, targeting the SAML authentication endpoints exposed by FortiOS, FortiProxy, and FortiSwitchManager web interfaces. An attacker can exploit this vulnerability by:

1. Intercepting or initiating a SAML authentication flow to the target Fortinet device
2. Crafting a malicious SAML response with a forged or manipulated signature
3. Submitting the crafted response to the vulnerable device's authentication endpoint
4. Bypassing authentication and gaining unauthorized access with arbitrary user privileges

Security researchers at Arctic Wolf have observed malicious SSO login activity exploiting this vulnerability in conjunction with CVE-2025-59719. The attack does not require authentication, user interaction, or any special privileges, making it a highly attractive target for threat actors.

Detection Methods for CVE-2025-59718

Indicators of Compromise

• Unexpected or anomalous administrator logins via FortiCloud SSO from unfamiliar IP addresses or geographic locations
• Authentication log entries showing successful SSO logins without corresponding identity provider authentication events
• Configuration changes to Fortinet devices performed by users who did not initiate the sessions
• Unusual SAML response patterns in web server logs, including responses with malformed or unexpected signature elements

Detection Strategies

• Monitor FortiOS, FortiProxy, and FortiSwitchManager authentication logs for anomalous SSO login patterns, particularly successful logins without corresponding identity provider activity
• Implement network detection rules to identify malformed SAML responses targeting Fortinet management interfaces
• Deploy SIEM correlation rules to alert on administrative actions following suspicious authentication events
• Review web application firewall logs for unusual POST requests to SAML authentication endpoints

Monitoring Recommendations

• Enable comprehensive logging on all Fortinet devices, including authentication events, configuration changes, and administrative actions
• Configure real-time alerting for any successful SSO authentications from unexpected sources
• Integrate Fortinet device logs with centralized SIEM platforms for correlation with identity provider authentication events
• Monitor for new administrator accounts or privilege escalation events following the vulnerability disclosure

How to Mitigate CVE-2025-59718

Immediate Actions Required

• Apply the latest security patches from Fortinet immediately for all affected FortiOS, FortiProxy, and FortiSwitchManager installations
• Review authentication logs for any signs of unauthorized access since the vulnerability disclosure
• Disable FortiCloud SSO authentication temporarily if immediate patching is not possible
• Restrict network access to Fortinet management interfaces to trusted administrative networks only
• Rotate credentials for all administrator accounts that may have been compromised

Patch Information

Fortinet has released security patches addressing this vulnerability. Organizations should consult the Fortinet PSIRT Advisory FG-IR-25-647 for specific patch versions and upgrade guidance. Given that this vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, federal agencies are required to remediate within prescribed timelines, and all organizations are strongly urged to prioritize patching.

Workarounds

• Disable FortiCloud SSO authentication and use local authentication or alternative identity providers until patches can be applied
• Implement strict network segmentation to limit access to Fortinet management interfaces from untrusted networks
• Deploy web application firewall rules to inspect and block malformed SAML responses targeting Fortinet devices
• Enable multi-factor authentication for all administrative access as an additional defense layer

# Restrict management interface access to trusted networks
config system interface
    edit "mgmt"
        set allowaccess ping https ssh
        set trusted-host 10.10.10.0/24
    next
end

# Disable FortiCloud SSO as temporary workaround
config system fortiguard
    set forticloud-sso disable
end