Fortinet FortiSwitchManager/FortiProxy/FortiOS SAML Response Message signature verification

Summaryinfo

A vulnerability, which was classified as very critical, was found in Fortinet FortiSwitchManager, FortiProxy and FortiOS. This affects an unknown function of the component SAML Response Message Handler. The manipulation results in signature verification. This vulnerability is reported as CVE-2025-59718. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Fortinet FortiSwitchManager, FortiProxy and FortiOS (affected version not known). Affected is some unknown functionality of the component SAML Response Message Handler. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

The advisory is available at fortiguard.fortinet.com. This vulnerability is traded as CVE-2025-59718 since 09/19/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/09/2026).

It is declared as attacked. This issue was added on 12/16/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 12/23/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2795). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Fortinet FortiOS
• Fortinet FortiProxy
• Fortinet FortiSwitch
• Fortinet FortiWeb

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiOS
• FortiProxy
• FortiSwitchManager

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion