CVE-2025-59718FortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
What broke
Fortinet FortiOS, FortiProxy, and FortiSwitchManager accepted a crafted SAML message as a valid FortiCloud SSO login (CWE-347, improper verification of a cryptographic signature). CVSS 9.8. Disclosed 9 December 2025. Arctic Wolf observed malicious SSO logins on FortiGate appliances beginning 12 December, three days later. CISA added CVE-2025-59718 to KEV on 16 December 2025 and set a federal patch-by date of 23 December 2025.
CVE-2025-59719 is the FortiWeb twin. CVE-2026-24858 is the follow-on that hits devices already patched for this pair.
Why it matters
This is the identity CVE that was exploited in the wild fastest in the 2025-2026 window. FortiCloud SSO sits on the management plane of firewalls and proxies. A SAML bypass there is not a user-app account takeover. It is administrative control of the network edge, after which ransomware crews do not need a second exploit.
What to do
- Patch now if FortiCloud SSO is enabled. If you do not need FortiCloud SSO, disable it.
- Hunt for rogue admin accounts and unexpected configuration changes from 12 December 2025 onward (Arctic Wolf's first observed exploitation).
- Do not stop at the 59718/59719 patch. Confirm you are also covered for CVE-2026-24858.
- Treat internet-facing management SSO as tier-zero. The same lesson as the Okta support-system teardown.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2025-59718
- CISA Known Exploited Vulnerabilities catalog (added 16 December 2025)
- Arctic Wolf, malicious FortiCloud SSO logins from 12 December 2025
Related identity CVEs
Related on Start with Identity
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.