CVE-2025-59718

This bug lets an attacker pretend to be you during SSO login. Instead of properly proving identity, the attacker can send a specially made login message and get in without a password. Think of it like a bouncer that can be tricked with a forged ticket—if you rely on that ticket to enter, your building is at risk.

This matters if your business runs Fortinet FortiOS, FortiProxy, or FortiSwitchManager (including deployments where FortiCloud SSO is used for access) at versions within the affected ranges for CVE-2025-59718. The KEV and reported exploitation mean the risk is real in the wild. It is a risk when the vulnerable product is reachable over the network (remote access) in its default/service exposure and the attacker can reach the component handling the SAML/SSO login flow—no login is required to trigger the bypass.

This is RED because CISA confirmed it as actively important via the KEV listing, and exploitation has been reported. Attackers can bypass SSO without authentication, which is exactly the kind of flaw that leads to rapid, unauthorized access and device takeovers. Treat this as an urgent patching event for all affected devices you operate.

1. Confirm exposure

• For each internet-facing or otherwise reachable Fortinet device/service you run, determine: (a) exact product name, (b) exact version, and (c) whether FortiCloud SSO / SAML-based login is used.
• Compare your version against the affected ranges for CVE-2025-59718.

2. Upgrade to fixed versions (primary remediation)

• FortiOS: upgrade to a version where CVE-2025-59718 is fixed (fixed in 7.0.18, or newer than the fixed threshold for your branch).
• FortiProxy: upgrade so it is at/above 7.0.22 (fixed in 7.0.22).
• FortiSwitchManager: upgrade so it is at/above 7.0.6 (fixed in 7.0.6).
• Follow Fortinet’s upgrade procedures for your platform to avoid downtime issues.

3. Mitigation if you cannot patch immediately

• Use Fortinet’s PSIRT advisory/mitigation guidance linked for this issue and apply the recommended mitigations right away if upgrading is delayed.
• If Fortinet support provides additional steps based on your environment, follow those steps immediately.

4. Timing

• CISA KEV remediation due date: 2025-12-23.

5. What to monitor after changes

• Look for signs of unauthorized access attempts around the SSO/SAML login flow and any unusual authentication/session behavior.
• Monitor device/system logs for unexpected administrative actions after the time window when the vulnerability may have been reachable.

Note: No public exploit code was found in the supplied findings, but CISA KEV and exploitation reporting still make patching urgent.

Severity is critical (CVSS 9.8 in the record). The underlying issue is a cryptographic signature verification failure in the SSO/SAML handling path (CWE-347), where a remote attacker can bypass FortiCloud SSO authentication by sending a crafted SAML response. The attack is remote and does not require authentication or user interaction. CISA KEV is confirmed (listed with a 2025-12-23 due date), and exploitation has been reported in the context of real incidents. EPSS is elevated and trending upward in predictions, but KEV/exploitation confirmation is the dominant indicator for urgency. Exploit maturity: at least “in the wild” activity is indicated by exploitation reporting; no public exploit code is noted in the findings, which suggests attackers can still operationalize the flaw without relying on a published tool.