CVE-2025-59718: 
FortiOS vulnerability analysis and mitigation

CVE-2025-59718 is a critical improper verification of cryptographic signature vulnerability (CWE-347) in Fortinet's FortiCloud SSO login authentication mechanism. It allows unauthenticated attackers to bypass FortiCloud SSO login by sending a crafted SAML response message. Affected products include FortiOS 7.0.0–7.0.17, 7.2.0–7.2.11, 7.4.0–7.4.8, and 7.6.0–7.6.3; FortiProxy 7.0.0–7.0.21, 7.2.0–7.2.14, 7.4.0–7.4.10, and 7.6.0–7.6.3; FortiSwitchManager 7.0.0–7.0.5 and 7.2.0–7.2.6; and FortiWeb across multiple versions. The vulnerability was disclosed on December 9, 2025, and added to CISA's Known Exploited Vulnerabilities (KEV) catalog on December 16, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical) (Fortinet PSIRT, CISA KEV).

The root cause is improper verification of cryptographic signatures in the SAML-based FortiCloud SSO authentication flow (CWE-347). When FortiCloud SSO is enabled, the affected products fail to properly validate the cryptographic signature of incoming SAML response messages, allowing an attacker to forge a valid-looking SAML assertion without possessing the legitimate signing key. The attack is network-based, requires no authentication, no user interaction, and low complexity — an attacker simply sends a crafted HTTP request containing a malicious SAML message to the management interface. The feature is not enabled by default but is commonly activated when administrators register devices to FortiCare via the GUI, unless the 'Allow administrative login using FortiCloud SSO' toggle is explicitly disabled during registration. A public PoC was published on GitHub (github.com/exfil0/CVE-2025-59718-PoC), and a technical analysis was published by OPSWAT (OPSWAT Analysis) and Rapid7 (Rapid7 ETR).

Successful exploitation grants an unauthenticated attacker complete administrative access to affected Fortinet security appliances, including FortiGate firewalls. Observed post-exploitation activity includes exfiltration of full firewall configurations (containing hashed credentials, network topology, and policy details), creation of rogue administrative accounts, and unauthorized modification of firewall rules. Over 25,000 internet-exposed devices were identified as vulnerable, and incident response findings revealed that attackers leveraged stolen service account credentials from compromised FortiGate devices to pivot into internal networks, compromise Active Directory environments, and deploy rogue workstations — enabling deep lateral movement (Arctic Wolf, SentinelOne, BleepingComputer).

Active exploitation was confirmed in the wild within days of the December 9, 2025 patch release, with Arctic Wolf observing malicious SSO logins beginning December 12, 2025. CISA added CVE-2025-59718 to its KEV catalog on December 16, 2025, with a remediation due date of December 23, 2025 (CISA KEV). A public PoC was published on GitHub, and automated attack campaigns were subsequently observed targeting FortiGate devices globally. Notably, Fortinet later confirmed in January 2026 that the initial patches were not fully effective, with exploitation continuing against devices running supposedly patched firmware versions (e.g., FortiOS 7.4.9), leading to disclosure of a related zero-day CVE-2026-24858 (BleepingComputer). The EPSS score is approximately 0.089%. The vulnerability has been linked to ransomware-adjacent campaigns, including activity by a Qilin affiliate (Ctrl-Alt-Intel). No specific nation-state attribution has been confirmed.

1. Reconnaissance: Use Shodan, Censys, or Shadowserver data to identify internet-facing FortiGate, FortiProxy, or FortiSwitchManager devices running vulnerable firmware versions with the management interface exposed. Confirm FortiCloud SSO is enabled (common on devices registered to FortiCare via GUI).
2. Craft malicious SAML response: Construct a forged SAML authentication response message that bypasses signature verification. Because the product fails to properly validate the cryptographic signature, the attacker does not need the legitimate IdP signing key — a crafted or unsigned/improperly signed assertion is accepted.
3. Send crafted request to management interface: Submit the malicious SAML response to the FortiCloud SSO authentication endpoint on the target device's management interface (typically HTTPS on port 443 or 8443).
4. Achieve administrative access: The device processes the forged SAML assertion and grants the attacker a session with super_admin privileges (typically as the 'admin' account), as evidenced by log entries showing method="sso" and profile="super_admin".
5. Exfiltrate configuration: Using the authenticated GUI session, download the full device configuration file (System → Backup), which contains hashed credentials, firewall rules, VPN configurations, and LDAP/AD connection details.
6. Establish persistence and pivot: Create rogue administrative accounts, modify firewall policies to allow attacker-controlled traffic, crack offline the hashed credentials from the exfiltrated config, and use recovered service account credentials to move laterally into the internal network and Active Directory (Arctic Wolf, Fortinet PSIRT).

• Network: Inbound SSO authentication requests to the FortiGate management interface originating from unexpected external IPs, particularly from hosting providers such as The Constant Company (45.32.153[.]218, 167.179.76[.]111, 199.247.7[.]82), Bl Networks (45.61.136[.]7), and Kaopu Cloud HK (38.54.88[.]203, 38.54.95[.]226, 38.60.212[.]97).
• Logs (FortiOS event logs): Log entries with logid="0100032001", method="sso", ui="sso(<external_IP>)", action="login", status="success", and profile="super_admin" from unexpected source IPs. Subsequent entries with logid="0100032095", action="download", and msg indicating system config file download via GUI from the same external IP.
• Logs (authentication): Admin login events for the built-in 'admin' account via SSO method from IPs not associated with legitimate FortiCloud infrastructure.
• File System / Configuration: Unexpected new administrative accounts created on the device; modified firewall policies or VPN configurations not matching change management records; configuration backup files downloaded at unusual times.
• Process / Behavior: Automated, rapid sequential logins and configuration downloads across multiple devices from the same source IP ranges; LDAP/AD service account password changes or new authentications from FortiGate IP addresses into internal directory services shortly after SSO login events (Arctic Wolf, Kaspersky SIEM Rules).

Immediate workaround: Disable the FortiCloud SSO login feature by navigating to System → Settings and toggling 'Allow administrative login using FortiCloud SSO' to Off, or via CLI: config system global, set admin-forticloud-sso-login disable, end. This mitigates the attack vector without requiring a firmware upgrade (Fortinet PSIRT).

Patched versions (upgrade to these or later):

• FortiOS: 7.0.18+, 7.2.12+, 7.4.9+, 7.6.4+
• FortiProxy: 7.0.22+, 7.2.15+, 7.4.11+, 7.6.4+
• FortiSwitchManager: 7.0.6+, 7.2.7+
• FortiWeb: 7.4.10+, 7.6.5+, 8.0.1+

Important caveat: Fortinet confirmed in January 2026 that the initial patches were not fully effective and that exploitation continued on patched devices; a follow-on zero-day (CVE-2026-24858) was disclosed January 28, 2026. Administrators should verify they are running the latest available firmware and monitor for the related advisory. Additionally, restrict management interface access to trusted internal networks, reset credentials if compromise is suspected, and review audit logs for malicious SSO login indicators (BleepingComputer, CISA KEV).

Fortinet published a PSIRT blog post titled 'Analysis of SSO Abuse on FortiOS' in January 2026 acknowledging active exploitation and the incomplete patch situation (Fortinet Blog). Arctic Wolf was among the first to publicly document active exploitation, reporting malicious SSO logins beginning December 12, 2025 — just three days after patch release — and later observing a second wave of automated attacks in January 2026 involving configuration theft (Arctic Wolf). Rapid7, SecurityWeek, BleepingComputer, The Hacker News, and Dark Reading all covered the vulnerability extensively, with SecurityWeek noting a 'new wave of attacks' in January 2026 (SecurityWeek). The MSP and Fortinet administrator communities on Reddit expressed significant frustration, particularly after reports emerged that fully patched devices were still being compromised. Kaspersky published SIEM detection rules to help defenders identify exploitation attempts (Kaspersky). The vulnerability was widely cited as emblematic of the broader 2025 trend of network edge device exploitation.