Fortinet fixed two critical authentication-bypass vulnerabilities

Fortinet fixed two critical authentication-bypass vulnerabilities, tracked as CVE-2025-59718 and CVE-2025-59719, affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager when FortiCloud SSO is enabled. According to Fortinet PSIRT, both flaws stem from improper verification of cryptographic signatures, allowing an unauthenticated attacker to bypass FortiCloud SSO login using a crafted SAML message.

FortiCloud SSO is disabled by default, but it can become enabled automatically during FortiCare registration unless an administrator disables the “Allow administrative login using FortiCloud SSO” toggle on the registration page. The vendor advises disabling the FortiCloud login feature if it is enabled until systems are upgraded to non-affected versions.

The article lists affected FortiOS versions (7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17) with upgrades required (7.6.4+, 7.4.9+, 7.2.12+, 7.0.18+ respectively), and FortiProxy 7.6.0–7.6.3, 7.4.0–7.4.10, 7.2.0–7.2.14, 7.0.0–7.0.21, plus FortiSwitchManager and FortiWeb variants. Disclosures note the vulnerabilities were discovered by Yonghui Han and Theo Leleu, and it remains unclear whether they have been exploited in the wild. December 10, 2025.