Fortinet Addresses Critical Vulnerabilities Impacting Multiple Fortinet Products (CVE-2025-59718 & CVE-2025-59719)

Fortinet releases fixes to address two critical vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Tracked as CVE-2025-59718 and CVE-2025-59719, both vulnerabilities have a CVSS score of 9.1. Successful exploitation of the vulnerabilities could lead to improper access control.

An improper verification of cryptographic signatures vulnerability in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager may allow an unauthenticated attacker to bypass FortiCloud Single Sign-On (SSO) login authentication with a crafted SAML message, if this feature is enabled on the device.

It’s important to note that the FortiCloud SSO login feature is not enabled by default in the factory settings. However, when an administrator registers the device to FortiCare from the device’s GUI, unless the administrator disables the toggle switch “Allow administrative login using FortiCloud SSO” in the registration page, FortiCloud SSO login is enabled upon registration.

Affected and Patched Versions

Please refer to the FortiGuard Security Advisory (FG-IR-25-647) for more information.

Workaround

Users can temporarily disable the FortiCloud login feature (if enabled) until upgrading to a fixed version.

To turn off FortiCloud login, go to System -> Settings -> Switch “Allow administrative login using FortiCloud SSO” to Off. Or type the following command in the CLI:

config system global
set admin-forticloud-sso-login disable
end

Qualys Detection

Qualys customers can scan their devices with QIDs 44861 and 44862 to detect vulnerable assets.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

Reference
https://www.fortiguard.com/psirt/FG-IR-25-647