CVE-2025-59719

9.8

CRITICAL CVSS 3.1

Fortinet FortiWeb Cryptographic Signature Verification Bypass Vulnerability

Overview

Description

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Details

INFO

Published Date :

Dec. 9, 2025, 6:15 p.m.

Last Modified :

Dec. 9, 2025, 7:59 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2025-59719 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Fortinet	fortiweb

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				6abe59d8-c742-4dff-8ce8-9b0ca1073da8
	CVSS 3.1	CRITICAL				[email protected]

Solution

Apply the available patch to address improper cryptographic signature verification and bypass FortiCloud SSO login.

Update FortiWeb to a patched version.
Verify SAML response integrity.
Ensure proper SSO configuration.

Public PoC/Exploit Available at Github

CVE-2025-59719 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-59719.

URL	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-647	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-59719 is associated with the following CWEs:

CWE-347: Improper Verification of Cryptographic Signature

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-59719 weaknesses.

CAPEC-463: Padding Oracle Crypto Attack Padding Oracle Crypto Attack CAPEC-475: Signature Spoofing by Improper Validation Signature Spoofing by Improper Validation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

moften/CVE-2025-59718-Fortinet-Poc

PoC para determinar si Fortinet es vulnerable a CVE-2025-59718 / CVE-2025-59719

Python

Updated: 2 months, 3 weeks ago

1 stars 0 fork 0 watcher

Born at : Dec. 27, 2025, 4:24 a.m. This repo has been linked 2 different CVEs too.

exfil0/CVE-2025-59718-PoC

Fortinet announced two closely related authentication‑bypass vulnerabilities on 9 December 2025. Both flaws involve improper verification of cryptographic signatures (CWE‑347) in the handling of SAML responses for the FortiCloud SSO login feature.

Python

Updated: 3 months ago

1 stars 3 fork 3 watcher

Born at : Dec. 17, 2025, 11:33 a.m. This repo has been linked 2 different CVEs too.

f00dikator/SAML-parser

parse SAML responses from a pcap

Python

Updated: 3 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Dec. 11, 2025, 2:45 p.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-59719 vulnerability anywhere in the article.

Daily CyberSecurity

SentinelOne Unmasks Exploitation of FortiGate Appliances as Gateways to Network Takeover

The SentinelOne Digital Forensics & Incident Response (DFIR) team issued a warning: the very appliances designed to protect organizations are being turned against them. Recent investigations revealed ...

Published Date: Mar 15, 2026 (1 week, 4 days ago)

CybersecurityNews

FortiGate Firewalls Exploited in Wave of Attacks to Breach Networks and Steal Credentials

A series of intrusions in early 2026 in which threat actors compromised FortiGate Next-Generation Firewalls (NGFW) to establish persistent footholds within enterprise environments. Each case was inter ...

Published Date: Mar 15, 2026 (1 week, 4 days ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 11

The Good | Authorities Disrupt Proxy Network and Charge BlackCat Insider, Vendors Patch Critical RCE Bugs U.S. and European law enforcement have dismantled the SocksEscort cybercrime proxy network, wh ...

Published Date: Mar 13, 2026 (1 week, 6 days ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 11

Published Date: Mar 13, 2026 (1 week, 6 days ago)

The Hacker News

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The ac ...

Published Date: Mar 10, 2026 (2 weeks, 2 days ago)

SentinelOne

FortiGate Edge Intrusions | Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

Overview Throughout early 2026, SentinelOne’s® Digital Forensics & Incident Response (DFIR) team has responded to several incidents where FortiGate Next-Generation Firewall (NGFW) appliances have been ...

Published Date: Mar 10, 2026 (2 weeks, 2 days ago)

SentinelOne

FortiGate Edge Intrusions | Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

Published Date: Mar 10, 2026 (2 weeks, 2 days ago)

Kaspersky

SIEM Rules for detecting exploitation of vulnerabilities in FortiCloud SSO

SIEM Kaspersky SIEM got a set of correlation rules for detecting attempts to exploit vulnerabilities for authentication bypass in Fortinet products. Igor Talankin February 5, 2026 Over the past two mo ...

Published Date: Feb 05, 2026 (1 month, 3 weeks ago)

CybersecurityNews

Fortinet Disables FortiCloud SSO Following 0-day Vulnerability Exploited in the Wild

Fortinet temporarily disabled its FortiCloud Single Sign-On (SSO) service after confirming active exploitation of a zero-day authentication bypass vulnerability in multiple products. The issue, tracke ...

Published Date: Jan 28, 2026 (1 month, 3 weeks ago)

The Hacker News

Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

Fortinet has officially confirmed that it's working to completely plug a FortiCloud SSO authentication bypass vulnerability following reports of fresh exploitation activity on fully-patched firewalls. ...

Published Date: Jan 23, 2026 (2 months ago)

CybersecurityNews

Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass Vulnerability

Fortinet confirms active exploitation of a FortiCloud SSO authentication bypass vulnerability, with a new automated campaign targeting even fully patched FortiGate devices. Cybersecurity firm Arctic W ...

Published Date: Jan 23, 2026 (2 months ago)

Daily CyberSecurity

“New” Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits

Fortinet is investigating a concerning new wave of attacks targeting its network security devices, where threat actors are successfully compromising systems that have already been fully patched agains ...

Published Date: Jan 23, 2026 (2 months ago)

The Register

FortiGate firewalls hit by silent SSO intrusions and config theft

FortiGate firewalls are getting quietly reconfigured and stripped down by miscreants who've figured out how to sidestep SSO protections and grab sensitive settings right out of the box. That's accordi ...