← Back to KEV catalog

CVE-2025-59718

Exploitation: active CVSS 9.1 CRITICAL

CVSS base score: 9.1 (Critical) vendor CNA · v3.1

Score assigned by the vendor's own CVE Numbering Authority (CNA); CISA's Vulnrichment program adds a score only when the CNA omits one.

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Vendor: Fortinet   Product: Multiple Products

Description

Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

Lifecycle Timeline

Each milestone comes from a different source, so gaps between them are gaps in what those sources publish, not evidence that nothing happened. EPSS history for this CVE holds 53 points from 2025-12-13, tracked daily from 2026-09-09; earlier points are weekly, which dates a spike to within a week. Peak probability 68.7% on 2026-08-29.

Published Applicability

CVE List v5 (CNA container) 10 affected · 0 fixed · 0 not affected
CVE List v5 (ADP/Vulnrichment) 1 affected · 0 fixed · 0 not affected

Check whether a specific version is affected →

What each source publishes about which product versions carry this vulnerability, kept as written rather than merged. Absence here means no source has published applicability data, not that nothing is affected.

Research & News Coverage

No mentions found in monitored research blogs or news feeds.

Detection & Exploitation

Scan
none published
Exploit / Pen Test
Network IDS/IPS
none published
Host / SIEM
none published

Coverage across public collections only: Nuclei and OpenVAS NVT (scan); Snort and Suricata ET Open (network); Sigma and YARA (host/SIEM); Metasploit, Exploit-DB and public GitHub repositories (exploit). Absence here means nothing public was found, not that detection is impossible.
GitHub PoC repositories are collected automatically by PoC-in-GitHub (CC0) and are not vetted: some are fakes and some are malware. Treat them as evidence that code was published, not as code to run.
OpenVAS coverage derives from the Greenbone Community Feed, made available under the Open Database License (ODbL) v1.0; its individual Vulnerability Tests are licensed GNU GPL v2.

CISA Assessment (Vulnrichment / SSVC)

active
yes
total
—
9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-347 — Improper access control
2025-12-09

KEV Catalog Status

2025-12-16
2025-12-23
Unknown

Listed By

SourceDateRecord
CISA Vulnrichment 2025-12-09 source record →
CISA KEV 2025-12-16 source record →

Referenced in Advisories

DateAdvisoryIssuer
2026-01-28 Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858 CISA

Weaponization Timeline — Offensive & Testing Tools

No exploit-tool sightings recorded for this CVE.

Evidence tiers are explained on the About page — a merged Metasploit module is far stronger evidence than a distro package mention.

External References