U.S. CISA adds a flaw in multiple Fortinet products to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet’s vulnerability tracked as CVE-2025-59718 to its Known Exploited Vulnerabilities catalog, noting a CVSS score of 9.1. The flaws, described as improper verification of cryptographic signatures, affect FortiOS, FortiWeb, FortiProxy and FortiSwitchManager when FortiCloud SSO is enabled, enabling an unauthenticated attacker to bypass FortiCloud SSO login with a crafted SAML message.

Arctic Wolf researchers observed attackers exploiting these authentication bypass flaws starting on December 12, three days after patches were issued, with initial activity involving malicious SSO logins to FortiGate devices and targeting admin accounts from several hosting providers.

Fortinet has released patches across multiple Fortinet products and advises disabling FortiCloud SSO admin login as a temporary mitigation; the advisory lists affected versions for FortiOS, FortiProxy, FortiSwitchManager and FortiWeb, with upgrade paths to non-affected releases. Administrators are urged to check for signs of compromise, reset credentials if needed, and to address the vulnerabilities in line with CISA’s KEV guidance, which includes deadlines such as December 23, 2025 for federal agencies.