CVE-2025-59719

This vulnerability is about “fake login messages.” An attacker can create a special SAML message that tricks your SSO login flow into accepting them as someone else—without needing any passwords. If your business uses FortiCloud SSO with the affected FortiWeb versions, attackers can potentially get in as real users, which can lead to data access and system changes.

This matters if you run Fortinet FortiWeb (including the Fortinet products listed as affecting ecosystems: fortiweb, fortios, fortiproxy, fortiswitchmanager) in versions 8.0.0 or 7.6.0–7.6.4 or 7.4.0–7.4.9 and you have FortiCloud SSO login enabled and configured.

It’s a risk even without credentials, and there’s no required user action described. Based on the findings, focus on reachability through your FortiCloud SSO setup (network access to the relevant SSO/login functionality).

This is RED because it’s been exploited in the real world as part of the FortiBleed campaign, and attackers used it to bypass authentication via FortiCloud SSO.

Given the unauthenticated nature of the bypass, exposed, configured systems are especially likely to be targeted aggressively.

Confirm whether we’re exposed

1. Identify the exact product and version running in your environment for Fortinet FortiWeb.
2. Verify whether FortiCloud SSO login is enabled and configured (the attack described depends on FortiCloud SSO being on).
3. If you fall in these affected ranges, treat the SSO configuration as compromised risk until patched:
   • FortiWeb 8.0.0
   • FortiWeb 7.6.0 through 7.6.4
   • FortiWeb 7.4.0 through 7.4.9

Remediate (use Fortinet’s fixed versions / secure procedure)

4. Follow Fortinet’s PSIRT guidance FG-IR-25-647 and complete the secure update recommendation procedure via Fortinet support/customer support.
5. Apply the vendor-listed upgrade targets for related Fortinet components where applicable (from the patch finding):
   • FortiProxy: upgrade to 7.6.4 or above; or 7.4.11 or above; or 7.2.15 or above (as listed in your PSIRT excerpt)
   • FortiSwitchManager: upgrade to 7.2.7 or above; or 7.0.6 or above (as listed in your PSIRT excerpt)
   • For FortiWeb specifically: contact Fortinet support to obtain the correct fixed FortiWeb version for your branch/model and perform it through the secure update workflow.

Temporary risk reduction if patching is delayed

6. Restrict network access to SSO/SSO-related endpoints and any externally reachable FortiCloud SSO functionality (block internet access where feasible and limit by IP/VPN).
7. Ensure MFA is in place for the underlying accounts where possible (this won’t “fix” the bypass by itself, but it can reduce attacker usefulness if they obtain partial access).

What to monitor

8. Monitor for unusual FortiCloud SSO login activity consistent with authentication bypass attempts (e.g., logins occurring without normal user behavior), and check for follow-on signs of access: configuration changes, new sessions, or unexpected admin activity.

Timing note

9. Because exploitation is reported in the wild, prioritize patch completion immediately rather than scheduling for the next maintenance window.

CVE-2025-59719 is a cryptographic signature verification failure (CWE-347) affecting Fortinet FortiWeb 8.0.0, 7.6.0–7.6.4, and 7.4.0–7.4.9. The mechanism allows an unauthenticated attacker to bypass FortiCloud SSO authentication by sending a crafted SAML response that is not properly verified.

Exploitation status: exploitation is reported as YES, and the finding ties it to real-world activity in the FortiBleed campaign, where SSO bypasses were used to compromise large numbers of Fortinet devices and SSL VPN gateways.

KEV status: not listed in CISA KEV (so this is not KEV-confirmed by the findings). No public exploit code is listed in the findings, but that does not reduce the risk given real-world exploitation.

EPSS prediction exists and trends upward, but the verdict here is driven by reported exploitation rather than prediction.