DaystoPatch

FortinetExploited incident

FortiCloud SSO login authentication bypass via crafted SAML message

CVE-2025-59718, CVE-2025-59719Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 16 Dec 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statementUnverified source
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date onlyUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-647CuratedQuote not checked yet

    2025-12-09: Initial publication

    Internally discovered; the advisory is the first public signal found.

    Source
    Fortinet PSIRT FG-IR-25-647 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2025-59718ClaimedQuote verified9 Dec 2025, 17:20 UTC

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6968b3473335dd12…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet9 Dec 2025, 17:57 UTC

    You can now share your thoughts on vulnerability CVE-2025-59718 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-59718)ClaimedQuote verified16 Dec 2025

    Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

    Added to CISA's KEV catalog on 2025-12-16.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Arctic Wolf Labs security bulletinCuratedQuote verified16 Dec 2025

    On 12 December 2025, Arctic Wolf began observing intrusions involving malicious SSO logins on FortiGate appliances.

    First public exploitation report found; bulletin dated '16 December, 2025' on the page. Exploitation observed from 12 Dec 2025, three days after fixes were published. The /resources/blog/ URL 301-redirects to this /resources/blog-uk/ URL.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b70e7bf24292f473…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet21 Jan 2026, 23:30 UTC

    📢 FortiGate : contournement de correctif sur l’authentification FortiCloud SSO (CVE-2025-59718) activement exploité 📝 BleepingComputer rappor... 📖 cyberveille : https:// cyberveille.ch/posts/2026-01-2 1-fortigate-contournement-de-correctif-sur-lauthentif

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-647CuratedQuote not checked yet

    2025-12-09: Initial publication

    Source
    Fortinet PSIRT FG-IR-25-647 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Fortinet PSIRT FG-IR-25-647 (Wayback snapshot 2025-12-10 01:17 UTC)CuratedQuote verified

    please turn off the FortiCloud login feature (if enabled) temporarily

    Workaround present in the earliest snapshot of the advisory, whose timeline reads '2025-12-09: Initial publication'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ddda3269ee16b14d…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Fortinet PSIRT FG-IR-25-647CuratedQuote verified

    Upgrade to 7.0.18 or above

    Fixed versions were listed in the initial publication (2025-12-09; confirmed by Wayback snapshot 20251210011725). The fixed builds may have shipped before the advisory (internally found issue); that earlier date is not evidenced here. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Source
    Fortinet PSIRT FG-IR-25-647 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:608aa416ae4952c4…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-25-647 (Wayback snapshot 2025-12-10 01:17 UTC)CuratedQuote verified

    Upgrade to 8.0.1 or above

    The earliest snapshot already lists a fixed version for every affected branch (FortiOS 7.6/7.4/7.2/7.0, FortiProxy 7.6/7.4/7.2/7.0, FortiSwitchManager 7.2/7.0, FortiWeb 8.0/7.6/7.4).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ddda3269ee16b14d…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiOS
  • FortiProxy
  • FortiSwitchManager
  • FortiWeb
How we built this timeline

Coordinated/internal disclosure: fixes and a workaround were published 9 Dec 2025; Arctic Wolf saw exploitation from 12 Dec 2025, so exploited before a fix is false.

CVE-2025-59719 is the FortiWeb CVE in the same advisory (not itself in KEV as of the cache). The advisory page was later redesigned: earlier captures label the CVSS temporal score (9.1) as 'CVSSv3 Score', while the current template shows the base score 9.8 and the temporal score 9.1 separately, with the same vector, so the score itself did not change.

The 'Known Exploited' field arrived with that site-wide template change (independent edits audit, 23 Oct 2026). In January 2026 attackers also compromised fully patched devices through FortiCloud SSO; that is tracked separately as CVE-2026-24858 (fortinet-cve-2026-24858).

R1 check (23 Oct 2026): the January 2026 attacks on devices patched for this CVE used a different flaw that Fortinet assigned CVE-2026-24858 (a FortiCloud SSO alternate-path bypass, 'a new attack path'); Fortinet does not describe the December 2025 fixes as incomplete for CVE-2025-59718, so they remain First fix/Fixed for all versions here.

Cross-reference: fortinet-cve-2026-24858.

Related

Fortinet report card