Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2025-59718

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 t

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiSwitchManager

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.6affected
  • 7.0.0 to ≤ 7.0.5affected

Fortinet FortiOS

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.3affected
  • 7.4.0 to ≤ 7.4.8affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.0.0 to ≤ 7.0.17affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.3affected
  • 7.4.0 to ≤ 7.4.10affected
  • 7.2.0 to ≤ 7.2.14affected
  • 7.0.0 to ≤ 7.0.21affected

References