CVE-2025-59719

9.8

Fortinet · Fortinet FortiWeb

A critical vulnerability has been identified in multiple versions of Fortinet FortiWeb that allows an unauthenticated attacker to bypass the FortiCloud Single Sign-On (SSO) authentication.

Executive summary

A critical vulnerability has been identified in multiple versions of Fortinet FortiWeb that allows an unauthenticated attacker to bypass the FortiCloud Single Sign-On (SSO) authentication. Successful exploitation could grant an attacker unauthorized administrative access to the FortiWeb appliance, posing a significant risk to the security of protected web applications and sensitive data.

Vulnerability

The vulnerability is an improper verification of a cryptographic signature within the Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication process for FortiCloud. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted SAML response to the FortiWeb appliance. The system fails to correctly validate the digital signature of the SAML assertion, leading it to accept a fraudulent authentication claim, which allows the attacker to bypass the login mechanism and gain unauthorized access.

Business impact

This vulnerability is rated as critical with a CVSS score of 9.8, indicating a high potential for severe impact. A successful exploit would grant an unauthenticated attacker administrative access to the FortiWeb appliance. This could lead to the complete compromise of the organization's web application security posture, allowing the attacker to disable security policies, exfiltrate sensitive data passing through the WAF, and launch further attacks against backend web applications. The potential consequences include significant data breaches, application downtime, reputational damage, and regulatory penalties.

Remediation

Immediate Action: Organizations must immediately prioritize patching affected Fortinet FortiWeb appliances by updating to the latest version. Administrators should consult the official Fortinet security advisory for specific patched versions and detailed upgrade instructions. After patching, review access logs for any signs of compromise that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor for signs of exploitation. This includes reviewing FortiWeb access and authentication logs for anomalous SSO login attempts, particularly those involving malformed or unexpected SAML assertions. Monitor for any unauthorized or suspicious configuration changes to security policies, user accounts, or system settings. Network traffic analysis may reveal unusual communication patterns to and from the FortiWeb management interface.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Restrict network access to the FortiWeb management interface to a limited set of trusted IP addresses using firewall rules. If possible, place the management interface on a segregated, internal network segment, inaccessible from the public internet.

Exploitation status

Public Exploit Available: False

Analyst recommendation

This vulnerability represents a critical risk to the organization and requires immediate attention. Due to the CVSS score of 9.8, which signifies a trivial-to-exploit vulnerability that can lead to a complete system compromise by an unauthenticated attacker, we strongly recommend applying the vendor-supplied patches to all affected FortiWeb instances on an emergency basis. Although this CVE is not yet on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime target for future exploitation. Prioritize patching and monitoring to prevent a potential compromise of your web application security infrastructure.

Look Back #17

A look back, with hindsight

Published 2026-08-13. Reviewed with sources that didn't exist at disclosure time.

Backstory

FortiCloud SSO started as a FortiGate convenience feature. Fortinet introduced administrator login using FortiCloud single sign-on in FortiOS 7.0.0, letting an administrator authenticate to an appliance with a FortiCloud account instead of a local one. In FortiOS 7.0.4 the company made the feature self-activating: its own new-features documentation states that when the administrator registers the FortiGate to FortiCare, the "Allow administrative login using FortiCloud SSO" toggle is enabled by default. The setting's documented default is disable, but registration turns it on, so the feature was live on a far larger population of appliances than a default-off setting implies. Qualys put roughly 30,044 internet-exposed Fortinet instances in that state at the time of disclosure.

The design then spread across the product line. FortiWeb received it later than FortiGate. The admin-forticloud-sso-login setting is absent from the FortiWeb 7.2.0 system global CLI reference and present in the 7.4.1 one, and Fortinet's advisory lists FortiWeb 7.4.0 through 7.4.9, 7.6.0 through 7.6.4 and 8.0.0 as affected while marking 7.2, 7.0 and 6.4 not affected. The vulnerable code arrived with FortiWeb 7.4.0.

The architecture makes the appliance a SAML service provider and FortiCloud the identity provider. Administrative access no longer rests on a secret the device holds. It rests on the device correctly checking a cryptographic signature over an XML document that a browser hands it, and that check sits in front of authentication, so any weakness in it is reachable with no credentials at all.

Fortinet classified the flaw as CWE-347, improper verification of a cryptographic signature, and said only that a crafted SAML response may be accepted as valid. No public analysis has established which specific verification failure occurred. OPSWAT's Unit 515 and VulnCheck both examined the issue and published no exploitation mechanics. As bug-class context rather than a claim about FortiWeb's code, SAML signature checking has failed the same way across many implementations: Duo Labs disclosed in February 2018 that XML canonicalization discards comments during signature validation while text extraction returns only a substring, so inserting seven characters changed the asserted identity without invalidating the signature. That defect reached python-saml, ruby-saml, saml2-js, OmniAuth-SAML and Shibboleth's openSAML C++.

Fortinet found this one itself. The advisory credits Yonghui Han and Theo Leleu of the Fortinet Product Security team, and Fortinet has described the FortiCloud SSO bypasses as internally discovered during a code audit. It landed three weeks after watchTowr Labs determined that a FortiWeb path-traversal fix had shipped silently in release 8.0.2 on 28 October 2025 with no mention in the release notes, a flaw Fortinet went on to disclose as CVE-2025-64446 on 14 November 2025. VulnCheck's Caitlin Condon wrote at the time that "silently patching vulnerabilities is an established bad practice that enables attackers and harms defenders, particularly for devices and systems (including FortiWeb) that have previously been exploited in the wild." Fortinet responded that it "diligently balances our commitment to the security of our customers and our culture of responsible transparency."

Technical analysis (revisited)

The bug class is CWE-347. The attack primitive is a crafted SAML response that the appliance accepts as validly signed, reached over the network with no credentials, which is why both the vendor and NVD score it in the critical band. The scores themselves diverge: Fortinet's CNA record gives 9.1 with the temporal metrics E:F/RL:O/RC:C, while NVD assigns 9.8 on AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The original analyst note carried the NVD figure.

Eight months of hindsight change the scoping more than the score. Advisory FG-IR-25-647 covers two CVE IDs for one flaw in one code path: CVE-2025-59718 for FortiOS, FortiProxy and FortiSwitchManager, and CVE-2025-59719 for FortiWeb. The NVD entry for CVE-2025-59719 is FortiWeb-only, which understates the blast radius of the underlying defect and, as the outcome section shows, split the exploitation evidence away from this ID.

The mechanics remain undocumented in public. OPSWAT's Unit 515 ran an independent technical investigation, withheld exploitation details, and reported that published exploits "do not successfully bypass FortiCloud SSO authentication" and "fail to produce a valid authenticated session or administrative access." VulnCheck reached the same conclusion in December, describing the circulating GitHub code as fake or otherwise incomplete and finding neither sample functional in testing across a range of affected products and configurations. That matters for reading the early telemetry: VulnCheck warned that some claims of active exploitation "appear to be based on detections of non-functional PoCs, meaning that those attacks would not succeed in a real-world environment."

What the incident data does establish is the post-exploitation objective. Rapid7 and Arctic Wolf independently observed the same sequence against FortiGate appliances: authenticate as admin through SSO, then immediately download the system configuration file, which as Rapid7 notes "often contains hashed credentials." The device was the entry point, not the target.

The workaround is one CLI line, and it is the same line that describes the exposure: config system global / set admin-forticloud-sso-login disable / end.

Lifecycle timeline

2025-09-19: CVE-2025-59719 reserved at MITRE (source)
2025-12-09: Fortinet advisory FG-IR-25-647 published, covering CVE-2025-59718 and CVE-2025-59719 as one flaw across FortiOS, FortiProxy, FortiSwitchManager and FortiWeb (source)
2025-12-09: NVD entry published, CVSS 3.1 9.8, CWE-347 (source)
2025-12-09: Tenable Nessus plugin 277981 published, FortiWeb SSO login authentication bypass (source)
2025-12-10: Qualys detections published, QIDs 44861, 44862 and 530775, with roughly 30,044 internet-exposed instances reported as potentially vulnerable (source)
2025-12-12: First observed in-the-wild activity, malicious FortiCloud SSO logins against FortiGate appliances followed by configuration export (source)
2025-12-15: VulnCheck KEV adds both CVE-2025-59718 and CVE-2025-59719 (source)
2025-12-16: CISA KEV adds CVE-2025-59718 only, noting in the same entry that CVE-2025-59719 "pertains to the same problem" (source)
2025-12-17: Rapid7 observes exploitation attempts against honeypots and ships InsightVM and Nexpose authenticated checks (source)
2025-12-18: VulnCheck assesses the circulating public exploit code as non-functional (source)
2025-12-23: CISA KEV remediation deadline for CVE-2025-59718 (source)
2026-01-22: Fortinet PSIRT publishes its analysis of SSO abuse, reporting cases against devices already fully upgraded (source)
2026-01-26: Fortinet disables FortiCloud SSO cloud-side to prevent abuse (source)
2026-01-27: FortiCloud SSO restored with vulnerable devices blocked; CVE-2026-24858 added to CISA KEV (source)
2026-02-26: OPSWAT Unit 515 publishes its technical analysis, concluding the public exploit code cannot bypass FortiCloud SSO in practice (source)
2026-06-17: NVD entry last modified (source)

Real-world outcome

Exploitation of this flaw began three days after disclosure, and none of it is publicly attributed to this CVE ID.

Arctic Wolf recorded malicious FortiCloud SSO logins from 12 December 2025, against FortiGate appliances, followed by configuration export to the same attacker IP addresses through the GUI, and published seven source addresses. Rapid7 saw exploitation attempts against its honeypots from 17 December. Huntress observed matching configuration dumps in a third dataset. Every one of those observations is against FortiOS, and every one is attributed to CVE-2025-59718, the sibling ID in the same advisory. No public source documents a compromised FortiWeb appliance through CVE-2025-59719.

CISA followed that evidence. It added CVE-2025-59718 to the Known Exploited Vulnerabilities catalog on 16 December 2025 with a 23 December deadline, and left CVE-2025-59719 off the catalog while writing into the 59718 entry that "CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory." Confirmed against the live feed on 13 August 2026, CVE-2025-59719 is still not listed under its own ID. VulnCheck's KEV had added both a day earlier, on 15 December. Tenable's record, last updated 9 June 2026, carries the NVD 9.8 alongside an EPSS probability of 0.2367 and ranks the CVE as a vulnerability of interest rather than a top-tier priority.

The original CVE Brief analyst note, dated 9 December 2025, recorded no public proof-of-concept and no reports of exploitation, and predicted that exploit development would follow quickly. Malicious SSO logins against the sibling CVE began three days later. The exploit code that appeared publicly was assessed as non-functional by two firms, in December and again in February.

Patching did not end the story. Fortinet's PSIRT reported on 22 January 2026 that it had found "a number of cases where the exploit was to a device that had been fully upgraded to the latest release," a second attack path on the same feature. That became CVE-2026-24858, an alternate-channel authentication bypass letting a holder of any FortiCloud account with a registered device log into devices registered to other accounts. FortiWeb 7.4 through 8.0 are among the affected products. Fortinet disabled FortiCloud SSO cloud-side on 26 January and restored it the next day with vulnerable devices blocked, and its recommended actions ran past patching to auditing for rogue administrator accounts named audit, backup, itadmin, secadmin and support, and rotating credentials including the LDAP and Active Directory accounts bound to the devices.

Lessons

This case shows that a single flaw split across two CVE IDs will have its exploitation evidence split with it. The defect was one code path in one shared SAML implementation, documented in one advisory. Attackers reached it through FortiGate, so the FortiOS ID collected the incident reports, the honeypot hits and the KEV listing, while the FortiWeb ID collected none of them. Any tool that gates prioritisation on a literal KEV cveID match reports CVE-2025-59719 as not exploited, while CISA's own catalog text says the opposite in prose that no parser reads.

It also shows what a documented default can conceal. The CLI default for admin-forticloud-sso-login is disable, and the advisory still had to explain that FortiCare registration enables the feature unless an administrator turns it off. The number that describes the attack surface is not the shipped default, it is the count of registered devices.

The January sequel is the sharper point. Verifying a SAML signature correctly closed one way into the SSO path and left the trust relationship behind it intact, and devices that had applied every patch in FG-IR-25-647 were still reached. Fixing how an assertion is checked is not the same as fixing what the assertion is allowed to authorise.

Finally, the post-exploitation pattern was identical across three independent datasets: log in as admin, download the configuration, leave. The credentials inside that file outlive the patch.

CVE Brief Security Intelligence