CVE-2025-59718FortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
What broke
Fortinet FortiOS, FortiProxy, and FortiSwitchManager accepted a crafted SAML message as a valid FortiCloud SSO login (CWE-347, improper verification of a cryptographic signature). CVSS 9.8. Disclosed 9 December 2025. Arctic Wolf observed malicious SSO logins on FortiGate appliances beginning 12 December, three days later. CISA added CVE-2025-59718 to KEV on 16 December 2025 and set a federal patch-by date of 23 December 2025.
CVE-2025-59719 is the FortiWeb twin. CVE-2026-24858 is the follow-on that hits devices already patched for this pair.
Why it matters
This is the identity CVE that was exploited in the wild fastest in the 2025-2026 window. FortiCloud SSO sits on the management plane of firewalls and proxies. A SAML bypass there is not a user-app account takeover. It is administrative control of the network edge, after which ransomware crews do not need a second exploit.
What to do
- Patch now if FortiCloud SSO is enabled. If you do not need FortiCloud SSO, disable it.
- Hunt for rogue admin accounts and unexpected configuration changes from 12 December 2025 onward (Arctic Wolf's first observed exploitation).
- Do not stop at the 59718/59719 patch. Confirm you are also covered for CVE-2026-24858.
- Treat internet-facing management SSO as tier-zero. The same lesson as the Okta support-system teardown.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2025-59718
- CISA Known Exploited Vulnerabilities catalog (added 16 December 2025)
- Arctic Wolf, malicious FortiCloud SSO logins from 12 December 2025
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft 2025 · Identity infrastructure vulnerability
Related on Start with Identity
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- CVENetScaler SAML memory overflow exploited as a zero-day
CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway reachable only when the appliance acts as a SAML service provider or identity provider. Exploit
- GlossarySSO Identifier (SSO ID)
An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the `NameID` in a [SAML](/glossary/sam
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.