Authentication Bypass Vulnerability Affecting FortiOS, FortiProxy, and FortiSwitchManager
A critical vulnerability present in FortiOS, FortiProxy and FortiSwitchManager would allow a malicious actor to bypass the FortiCloud SSO authentication mechanism of the administration interface.
Description
Technical context and vulnerability details
FortiOS and FortiProxy are used as the Fortinet operating system and a secure proxy solution, respectively. As for FortiSwitchManager, it allows centralized management of multiple FortiSwitch switches from a single interface. These solutions are affected by a previously patched critical vulnerability labeled CVE-2025-59718 that results from insufficient validation of cryptographic signatures in the SAML authentication process. Exploitation of this vulnerability would allow an attacker to send specially crafted SAMLResponse requests to /remote/saml/login endpoints granting administrative access to affected systems. This vulnerability is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Bypassing the authentication mechanism;
- Unauthorized access to data;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- FortiOS: versions 7.6.0 to 7.6.3, 7.4.0 to 7.4.8, 7.2.0 to 7.2.11 and 7.0.0 to 7.0.17;
- FortiProxy: versions 7.6.0 to 7.6.3, 7.4.0 to 7.4.10, 7.2.0 to 7.2.14 and 7.0.0 to 7.0.21;
- FortiSwitchManager: versions 7.2.0 to 7.2.6 and 7.0.0 to 7.0.5;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- update FortiOS to versions 7.6.4, 7.4.9, 7.2.12, 7.0.18 or later;
- update FortiProxy to later versions 7.6.4, 7.4.11, 7.2.15, 7.0.22;
- update FortiSwitchManager to version 7.2.7, 7.0.6 or later;
- temporarily disable FortiCloud SSO;
- limit access to management interfaces;
Sources & External Links
Vendor security advisories and documentation
- https://cybersecuritynews.com/fortinet-sso-vulnerability-exploited/
- https://nvd.nist.gov/vuln/detail/CVE-2025-59718
- https://www.crowdsec.net/vulntracking-report/cve-2025-59718
- https://www.esentire.com/security-advisories/previously-patched-fortinet-vulnerability-cve-2025-59718-exploited-in-the-wild#:~:text=THE%20THREAT,the%20risk%20of%20potential%20exploitation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.