CVE-2025-59718

The vulnerability in Fortinet's FortiOS, FortiProxy, and FortiSwitchManager products arises from improper verification of cryptographic signatures, specifically in the handling of SAML (Security Assertion Markup Language) response messages. This flaw allows an unauthenticated attacker to craft a malicious SAML response that can bypass the FortiCloud Single Sign-On (SSO) login authentication mechanism. The affected versions span multiple releases, including FortiOS versions 7.6.0 to 7.6.3, 7.4.0 to 7.4.8, and earlier iterations, as well as corresponding versions of FortiProxy and FortiSwitchManager. The critical nature of this vulnerability is underscored by its high CVSS score, indicating a severe risk to systems utilizing these products.

Attackers can exploit this vulnerability through various vectors, primarily by sending specially crafted SAML responses to the affected systems. Since the flaw allows for the bypass of authentication mechanisms, an attacker could gain unauthorized access to sensitive resources without needing valid credentials. This could lead to a range of malicious activities, including data exfiltration, unauthorized configuration changes, or even lateral movement within the network. Given the widespread use of Fortinet products in enterprise environments, the potential for exploitation is significant, especially in organizations that rely heavily on SSO for user authentication.

The real-world impact of this vulnerability can be profound. Organizations that utilize Fortinet's solutions may face severe business risks, including data breaches, loss of sensitive information, and reputational damage. The ability for an attacker to bypass authentication can lead to unauthorized access to critical systems, potentially resulting in financial losses and regulatory penalties, particularly in industries that are subject to strict compliance requirements. Furthermore, the exploitation of this vulnerability could serve as a foothold for more extensive attacks, allowing adversaries to escalate privileges and compromise additional systems within the network.

To detect and mitigate the risks associated with this vulnerability, organizations should implement several strategies. Regularly updating and patching affected Fortinet products is essential to close the security gap. Security teams should also monitor logs for any unusual authentication attempts or access patterns that may indicate exploitation attempts. Additionally, employing intrusion detection systems (IDS) can help identify and alert on suspicious SAML traffic. Organizations should consider implementing multi-factor authentication (MFA) as an additional layer of security to protect against unauthorized access, even if the initial SSO mechanism is compromised.

In conclusion, the improper verification of cryptographic signatures in Fortinet products presents a critical security vulnerability that requires immediate attention. The potential for exploitation poses significant risks to organizations, making it imperative for cybersecurity teams to adopt proactive measures to safeguard their environments. By staying informed about the latest threats and implementing robust security practices, organizations can mitigate the impact of such vulnerabilities and enhance their overall security posture.

Recent updates to CVE-2025-59718 reveal a downward revision of the CVSS score from 9.8 to 9.1, reflecting a refined understanding of the vulnerability’s exploitability and impact. Despite this slight reduction in severity, our telemetry indicates a significant decline in detection activity related to this flaw, suggesting either a temporary lull in active exploitation or improved defensive postures among affected organizations. Contrarily, the Exploit Prediction Scoring System (EPSS) score has nearly doubled, rising by over 90%, signaling an increased likelihood of exploitation attempts in the near term. This divergence between reduced observed activity and heightened predictive risk underscores a complex threat landscape where adversaries may be preparing or refining exploit techniques rather than conducting widespread attacks currently. Notably, the presence of new proof-of-concept exploits publicly available on GitHub continues to lower the barrier for threat actors to weaponize this vulnerability. Although no confirmed ransomware campaigns have been linked to this CVE, the association of ransomware groups such as akira and ransomhub with related Fortinet vulnerabilities warrants continued vigilance. Overall, this update adjusts the risk assessment to a sustained critical threat level, emphasizing that while immediate exploitation may have slowed, the potential for rapid escalation remains elevated due to increased exploitability indicators and publicly accessible attack tools.

Update 2 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-59718, accompanied by a significant upward revision of its CVSS score to 9.8 and a substantial increase in the Exploit Prediction Scoring System (EPSS) metric. This surge in activity correlates with the recent public release of multiple proof-of-concept exploits, which have notably lowered the technical barrier for adversaries to weaponize this vulnerability. Our telemetry indicates that exploitation attempts are rapidly increasing, placing this vulnerability in the highest percentile of exploit likelihood. Although no direct ransomware campaigns have yet been conclusively linked to this CVE, the ongoing interest from ransomware-associated groups such as akira and ransomhub underscores the potential for future integration into malicious toolsets. The convergence of heightened exploitability, public exploit availability, and ransomware group attention elevates the threat posture, signaling an urgent need for defenders to maintain heightened situational awareness. Consequently, the risk assessment for CVE-2025-59718 is updated to reflect a sustained critical threat level with an increased probability of active exploitation in the near term.