Critical severity · published Dec 9, 2025
CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
In wildKEV
9.8
CVSS
68.3%
EPSS
Yes
On KEV
Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)68.3% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 16, 2025
Federal remediation dueDec 23, 2025
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiOS · Fortinet
7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.0 through 7.0.17 · source: vendor, NVD
FO
FortiProxy · Fortinet
7.6.0 through 7.6.3; 7.4.0 through 7.4.10; 7.2.0 through 7.2.14; 7.0.0 through 7.0.21 · source: vendor, NVD
FO
FortiSwitchManager · Fortinet
7.2.0 through 7.2.6; 7.0.0 through 7.0.5 · source: vendor, NVD
RA
Ruggedcom Ape1808 Firmware · Siemens
All versions, or not specified · source: NVD
RA
RUGGEDCOM APE1808 · Siemens
0 · source: CISA
MP
Multiple Products · Fortinet
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-59718: Fortinet Multiple Products - Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
MPMultiple ProductsCVE-2025-59718
Dec 16, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59718
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
fortiguard.fortinet.com
https://fortiguard.fortinet.com/psirt/FG-IR-25-647
More from FortiOS
9.8
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.8
CVE-2025-25249
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
9.8
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
9.8
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability
9.8
CVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability