FortiOS, FortiWeb, and FortiProxy Flaw
Fortinet has disclosed critical authentication bypass vulnerabilities affecting multiple products, enabling attackers to circumvent FortiCloud Single Sign-On login authentication through specially crafted SAML messages.
The flaws, tracked as CVE-2025-59718 and CVE-2025-59719, impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.
| Attribute | Details |
|---|---|
| CVE IDs | CVE-2025-59718, CVE-2025-59719 |
| Severity | Critical |
| CVSS v3 Score | 9.1 |
| Impact | Improper access control |
The security flaws stem from improper verification of cryptographic signatures in the affected products’ FortiCloud SSO login functionality.
With a CVSS score of 9.1, these critical vulnerabilities allow unauthenticated attackers to bypass authentication mechanisms when FortiCloud SSO is enabled on the device.
The attack can be executed remotely over the network without requiring any user interaction or privileges.
The vulnerabilities impact multiple Fortinet product lines. FortiOS versions 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3 are vulnerable.
FortiProxy is affected from versions 7.0.0 through 7.0.21, 7.2.0 through 7.2.14, 7.4.0 through 7.4.10, and 7.6.0 through 7.6.3.
FortiWeb versions 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 are also impacted. Additionally, FortiSwitchManager versions 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6 are vulnerable.
While FortiCloud SSO is not enabled by default, administrators who registered devices through the GUI may have inadvertently activated it.
Organizations should immediately turn off FortiCloud SSO login by navigating to System Settings and toggling off “Allow administrative login using FortiCloud SSO,” or by using the CLI command to turn it off.
Fortinet recommends upgrading to patched versions, including FortiOS 7.0.18, 7.2.12, 7.4.9, or 7.6.4 and above.
The vulnerabilities were discovered internally by Fortinet Product Security team members Yonghui Han and Theo Leleu.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…