CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Description
CVE-2025-59718 is a critical improper verification of cryptographic signature vulnerability affecting multiple Fortinet products including FortiOS, FortiProxy, and FortiSwitchManager. With a CVSS v3.1 base score of 9.8, this vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms by exploiting flawed cryptographic signature verification. The flaw impacts a wide range of FortiOS versions from 7.0.0 through 7.6.3, FortiProxy versions from 7.0.0 through 7.6.3, and FortiSwitchManager versions from 7.0.0 through 7.2.6. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 23, 2025, and has an EPSS score of 0.02414 (84.9th percentile), indicating a significantly elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 7.0.0, < 7.0.22; >= 7.2.0, < 7.2.15; >= 7.4.0, < 7.4.11; >= 7.6.0, < 7.6.4 |
| fortinet | fortiswitchmanager | >= 7.0.0, < 7.0.6; >= 7.2.0, < 7.2.7 |
| fortinet | fortios | >= 7.0.0, < 7.0.18; >= 7.2.0, < 7.2.12; >= 7.4.0, < 7.4.9; >= 7.6.0, < 7.6.4 |
| siemens | ruggedcom ape1808 firmware | - |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-647(Vendor Advisory)
- https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-864900.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718(US Government Resource)
Weakness Type
CWE-347: Improper Verification of Cryptographic Signature
CVE-2025-59718 is classified under CWE-347, which describes a condition where software does not properly verify the cryptographic signature of data, allowing an attacker to tamper with or forge signed content. In the context of this Fortinet vulnerability, the authentication mechanism relies on cryptographic signatures to validate session tokens or authentication requests, but the verification process contains a flaw that allows an attacker to craft requests that bypass authentication entirely. This type of weakness is particularly dangerous in network security appliances because these devices serve as trust boundaries, and a bypass at the authentication layer effectively negates the security controls they are designed to enforce. Learn more about CWE-347
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H) in the CVSS vector. An attacker who successfully exploits this vulnerability can gain unauthorized administrative access to the Fortinet appliance, enabling them to read sensitive configuration data including VPN credentials, modify firewall rules and routing policies, and disrupt network operations by altering or disabling security services.
Business Impact is critical for organizations using Fortinet appliances as their primary perimeter defense. FortiOS powers FortiGate firewalls, which are often the sole barrier between corporate networks and the internet. Unauthorized administrative access to a FortiGate device gives an attacker the ability to disable security policies, create VPN tunnels for persistent access, exfiltrate network traffic, and pivot into internal network segments. FortiProxy serves as a secure web gateway, and compromise of this component exposes all proxied web traffic to interception.
Exploitation Context is concerning. Arctic Wolf researchers have observed malicious SSO logins following the disclosure of this vulnerability, indicating that threat actors are actively leveraging this flaw. The EPSS score of 0.02414 (84.9th percentile) places it well above the average exploitation probability. The ransomware use status is listed as "Unknown" by CISA, but given the strategic value of compromised network appliances, ransomware operators are likely to incorporate this vulnerability into their attack chains.
Exploit Maturity
CVE-2025-59718 has confirmed active exploitation in the wild. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 23, 2025, confirming that federal agencies and critical infrastructure organizations must prioritize patching. Arctic Wolf has published research documenting malicious SSO login activity observed in the aftermath of this vulnerability's disclosure, providing concrete evidence of in-the-wild exploitation.
The EPSS score of 0.02414 (84.9th percentile) indicates this vulnerability is more likely to be exploited than approximately 85% of all known vulnerabilities. The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), making it highly amenable to automated exploitation. Fortinet appliances are widely deployed and internet-facing by design, which provides attackers with a large and easily discoverable attack surface. The ransomware association is listed as "Unknown" by CISA, but Fortinet appliance compromises have historically been leveraged by ransomware groups as initial access vectors.
Remediation
-
Upgrade Fortinet Products to Patched Versions — For FortiOS, upgrade to version 7.0.18, 7.2.12, 7.4.9, or 7.6.4 or later depending on your version branch. For FortiProxy, upgrade to version 7.0.22, 7.2.15, 7.4.11, or 7.6.4 or later. For FortiSwitchManager, upgrade to version 7.0.6 or 7.2.7 or later. Refer to Fortinet's PSIRT advisory FG-IR-25-647 for the complete list of fixed versions.
-
Audit Administrative Access Logs — Immediately review authentication logs on all Fortinet appliances for signs of unauthorized SSO logins or administrative access from unexpected IP addresses. Arctic Wolf has documented patterns of malicious SSO login activity associated with this vulnerability that can serve as indicators of compromise.
-
Rotate Administrative Credentials — After patching, rotate all administrative passwords, API keys, and VPN pre-shared keys configured on affected Fortinet devices. If the appliance was compromised prior to patching, existing credentials should be considered potentially exposed.
-
Restrict Management Interface Access — Ensure that administrative and management interfaces of Fortinet appliances are not exposed to the public internet. Use dedicated management networks, VPN-based access, or IP allowlists to limit who can reach the authentication endpoints targeted by this vulnerability.
-
Enable Enhanced Logging and Monitoring — Configure Fortinet appliances to forward authentication events and configuration changes to a centralized SIEM. Monitor for anomalous administrative sessions, policy modifications, and new VPN tunnel configurations that may indicate post-exploitation activity.
Technical Details
CVE-2025-59718 is an authentication bypass vulnerability rooted in improper verification of cryptographic signatures within the authentication subsystem of Fortinet FortiOS, FortiProxy, and FortiSwitchManager. The flaw allows a remote, unauthenticated attacker to forge authentication tokens or bypass signature validation checks, gaining administrative access to the appliance without valid credentials.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector indicates a near-maximum severity. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means no special conditions are required. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) means no legitimate user action is required. Scope (S:U) is unchanged, meaning the impact is confined to the vulnerable component itself. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The vulnerability exists in how the affected Fortinet products verify cryptographic signatures during the authentication process. When processing authentication requests, the software fails to properly validate the cryptographic signature associated with session tokens or authentication assertions. This allows an attacker to craft a request with a forged or manipulated signature that the system incorrectly accepts as valid, granting administrative access. The flaw spans multiple product lines because FortiOS, FortiProxy, and FortiSwitchManager share common authentication code paths. The broad range of affected versions, from 7.0.0 through current releases, suggests the vulnerability was introduced early in the shared codebase and persisted through multiple release cycles.
Frequently Asked Questions
What Fortinet products are affected by CVE-2025-59718?
FortiOS versions 7.0.0 through 7.6.3, FortiProxy versions 7.0.0 through 7.6.3, and FortiSwitchManager versions 7.0.0 through 7.2.6 are all affected. This covers FortiGate firewalls, FortiProxy secure web gateways, and FortiSwitchManager network switch management platforms.
Is CVE-2025-59718 being actively exploited?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, and Arctic Wolf has published research documenting malicious SSO login activity observed after the vulnerability's disclosure. Organizations should treat patching as an urgent priority.
Can an attacker exploit CVE-2025-59718 without credentials?
Yes. The vulnerability requires no authentication (PR:N) and no user interaction (UI:N). An attacker who can reach the authentication endpoint of an affected Fortinet appliance over the network can exploit this flaw to gain administrative access.
Is CVE-2025-59718 associated with ransomware?
CISA lists the ransomware association as "Unknown." However, Fortinet appliance compromises have historically served as initial access vectors for ransomware campaigns. Organizations should assume that any compromised appliance may be leveraged for ransomware deployment and respond accordingly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.