CVE-2025-59718: FortiCloud SSO Auth Bypass in FortiOS

On 9 December 2025, Fortinet published FG-IR-25-772, disclosing CVE-2025-59718 — a critical authentication bypass in the FortiCloud single sign-on (SSO) implementation used by FortiOS, FortiProxy and FortiSwitchManager. An unauthenticated remote attacker who can reach the administrative interface can forge a SAML assertion and obtain a valid administrative session without valid credentials. Fortinet's advisory states the flaw is being exploited in the wild. This post breaks down the vulnerable code path, the affected version matrix, ATT&CK-mapped TTPs, a working Sigma rule, and the exact patched builds to move to.

What CVE-2025-59718 actually is

FortiCloud SSO is Fortinet's hosted identity provider for FortiGate, FortiProxy and FortiSwitchManager administrators. When an admin clicks Login with FortiCloud, the device generates a SAML AuthnRequest, redirects the browser to FortiCloud, and then consumes the signed SAML Response posted back to /remote/saml/login. The vulnerability is in the assertion-consumption step: the parser validates the XML signature over the assertion but fails to enforce that the signature reference URI matches the assertion ID that is actually being consumed. An attacker can therefore take any legitimately signed assertion — including one issued for a different FortiCloud tenant or a stale session — and re-target it at a victim device.

Fortinet's PSIRT rates the issue CVSS v3.1 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The NVD entry is at nvd.nist.gov/vuln/detail/CVE-2025-59718. CISA added it to the Known Exploited Vulnerabilities catalog on 11 December 2025 with a remediation due date of 25 December 2025, which is the strongest public signal that exploitation is not theoretical.

"An improper authentication vulnerability [CWE-287] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated attacker to bypass the FortiCloud SSO authentication and gain super-admin privileges via crafted SAML assertions." — Fortinet PSIRT, FG-IR-25-772

The pre-condition is that the device has FortiCloud SSO enabled as an admin authentication method. That is not the default on a fresh FortiGate, but it is extremely common in MSP-managed estates and in organisations that centralised FortiGate administration through FortiCloud.

Affected versions and the patch matrix

Per FG-IR-25-772, the following branches are affected. Anything at or below the listed build is vulnerable; the fix is the first build in the right-hand column.

• FortiOS 7.0 — 7.0.0 through 7.0.17 → upgrade to 7.0.18 or later
• FortiOS 7.2 — 7.2.0 through 7.2.11 → upgrade to 7.2.12 or later
• FortiOS 7.4 — 7.4.0 through 7.4.8 → upgrade to 7.4.9 or later
• FortiOS 7.6 — 7.6.0 through 7.6.3 → upgrade to 7.6.4 or later
• FortiProxy 7.0 — 7.0.0 through 7.0.21 → upgrade to 7.0.22 or later
• FortiProxy 7.2 — 7.2.0 through 7.2.13 → upgrade to 7.2.14 or later
• FortiProxy 7.4 — 7.4.0 through 7.4.7 → upgrade to 7.4.8 or later
• FortiSwitchManager 7.2 — 7.2.0 through 7.2.5 → upgrade to 7.2.6 or later

FortiOS 6.4 and earlier are end-of-support and will not receive a fix; Fortinet's guidance is to migrate. Confirm your exact build with get system status and cross-check the build number against the advisory table before assuming you are patched — Fortinet's build numbers do not map cleanly to semantic versioning.

Attacker TTPs, mapped to MITRE ATT&CK

Public reporting from Fortinet and from incident responders describes a consistent chain. It maps cleanly onto a small number of ATT&CK techniques, which is useful for detection engineering because you can hunt on the technique rather than the specific exploit tooling.

• T1190 — Exploit Public-Facing Application. The FortiGate management interface (HTTPS/443 or the custom admin port) is the entry vector. Exposure to the internet is the primary risk multiplier.
• T1078.004 — Valid Accounts: Cloud Accounts. The forged SAML assertion yields a session that the device treats as a legitimate FortiCloud-authenticated super-admin.
• T1136.001 — Create Account: Local Account. Post-exploitation, attackers create a local admin (for example config system admin / edit svc_backup / set accprofile super_admin) so they retain access after the SAML bug is patched.
• T1556.004 — Modify Authentication Process: Network Device Authentication. Observed follow-on activity includes adding a second LDAP or RADIUS server entry pointing at attacker-controlled infrastructure.
• T1562.004 — Impair Defenses: Disable or Modify System Firewall. Policies are added or widened to permit lateral movement into the protected network.

A recurring pattern in the public reporting is that the attacker's first action after login is to read config system admin and execute log display — reconnaissance before persistence. That behaviour is highly detectable if you are forwarding FortiGate event logs to a SIEM.

Detection: Sigma rule for the SAML bypass and its follow-on

The most reliable network-side signal is a successful SAML login followed within seconds by an administrative configuration change from the same source IP. The Sigma rule below targets FortiGate's event log category, which is forwarded via syslog or FortiAnalyzer. It has been tested against the standard Fortinet log source taxonomy used by Sigma.

title: FortiGate FortiCloud SSO Login Followed by Admin Config Change
id: 8b2f6c14-7a3e-4d51-9c2a-1e5f0b7d9c33
status: experimental
description: Detects a FortiCloud SSO administrative login immediately followed by
  a local admin account creation or config change, consistent with CVE-2025-59718 exploitation.
references:
  - https://www.fortiguard.com/psirt/FG-IR-25-772
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: CybernytronX
date: 2025/12/15
logsource:
  product: fortinet
  service: event
detection:
  selection_login:
    action: login
    logdesc|contains: 'FortiCloud'
    status: success
  selection_change:
    action:
      - add
      - edit
    cfgpath|startswith:
      - 'system.admin'
      - 'system.central-management'
      - 'user.radius'
      - 'user.ldap'
  timeframe: 2m
  condition: selection_login and selection_change
falsepositives:
  - Legitimate FortiCloud SSO admin performing bulk configuration changes
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1136.001

For teams that cannot use Sigma directly, the equivalent FortiGate log query is:

action="login" logdesc="FortiCloud SSO" status="success"
| join [ action="edit" cfgpath="system.admin" ]

On the network side, a Suricata rule can alert on POSTs to the SAML consumer endpoint that carry a SAMLResponse larger than the baseline for your estate — forged assertions are typically 8–20 KB and contain a signature block that does not match the assertion ID. Treat this as a low-fidelity heuristic, not a replacement for the log-based rule.

Mitigation: what to do in the next 24 hours

Fortinet's own guidance in FG-IR-25-772 lists three options, in order of preference:

1. Upgrade to the fixed build for your branch (see the matrix above). This is the only complete fix. Fortinet has published upgrade paths in the FortiOS Upgrade Guide.
2. Disable FortiCloud SSO as an admin authentication method if you cannot patch immediately. On FortiOS this is done under config system saml by removing the FortiCloud IdP entry, or under config system admin by clearing the remote-auth binding. This reverts you to local or LDAP/RADIUS authentication, which is not affected by the flaw.
3. Restrict management-plane access so that only trusted administrative networks can reach the HTTPS admin interface. Fortinet's hardening guidance is in Hardening your FortiGate; the relevant controls are set allowaccess on the management interface and the trusthost field on each admin account.

Because exploitation grants super-admin, patching is not sufficient on its own. After upgrading, audit config system admin for accounts you did not create, review config log fortianalyzer setting and config system central-management for unauthorised redirection, and rotate any API tokens or certificates stored on the device. CISA's KEV entry mandates remediation by 25 December 2025 for US federal agencies, which is a reasonable deadline for everyone else too.

Why this matters for defenders

The interesting thing about CVE-2025-59718 is not the XML signature bug — those are well understood — it is the identity model it breaks. FortiCloud SSO exists precisely so that administrators do not need per-device credentials, which means a single forged assertion unlocks every FortiGate in the tenant. In a managed-services estate with hundreds of devices, that is a lateral-movement primitive that bypasses every network segmentation control you have, because the attacker is not moving laterally at all — they are logging in legitimately, from the device's perspective, to each target in turn.

The second lesson is about the blast radius of the management plane. FortiGate is a security control, but it is also a Linux host with a shell, a certificate store, and often a route into every segment you own. Once an attacker has super-admin on the perimeter firewall, the rest of the incident is a foregone conclusion. The correct architectural response — internet-facing management interfaces should not exist, FortiCloud SSO should be scoped to a dedicated management VRF, and admin logins should be logged to an out-of-band collector the firewall cannot reach — is the same response that would have mitigated the last three Fortinet advisories. If your estate still has HTTPS admin exposed to 0.0.0.0/0, this CVE is your reminder to fix the architecture, not just the firmware.

Sources

• Fortinet PSIRT Advisory FG-IR-25-772 — the authoritative source for CVE-2025-59718, the affected version matrix, CVSS score, and Fortinet's recommended workarounds.
• NVD entry for CVE-2025-59718 — confirms the CVSS v3.1 vector and CWE-287 classification.
• CISA Known Exploited Vulnerabilities Catalog — confirms active exploitation and the 25 December 2025 federal remediation deadline.
• Fortinet — Hardening your FortiGate — vendor guidance on restricting management-plane access and admin trusthost configuration.

Frequently Asked Questions

Is CVE-2025-59718 exploitable if FortiCloud SSO is not enabled?

No. The flaw is in the SAML assertion-consumption path used by FortiCloud SSO. Devices that authenticate administrators only via local accounts, LDAP, or RADIUS are not reachable through this specific vulnerability. Confirm your configuration under config system saml and config system admin.

What is the CVSS score and severity?

Fortinet rates it CVSS v3.1 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The NVD entry at nvd.nist.gov/vuln/detail/CVE-2025-59718 mirrors this rating.

Can I mitigate without upgrading FortiOS?

Yes, temporarily. Disabling FortiCloud SSO as an admin authentication method removes the vulnerable code path entirely. Fortinet's advisory FG-IR-25-772 lists this as an acceptable interim workaround, but the only complete fix is the patched build for your branch.

How do I know if my FortiGate was already compromised?

Review config system admin for unrecognised accounts, check execute log display for successful FortiCloud logins from unexpected source IPs, and inspect config system central-management and config log fortianalyzer setting for unauthorised redirection. Any local admin account you did not create should be treated as attacker persistence.

Does this affect FortiAnalyzer or FortiManager?

FG-IR-25-772 scopes the vulnerability to FortiOS, FortiProxy, and FortiSwitchManager. FortiAnalyzer and FortiManager are not listed as affected in the advisory, but they should still be patched on their normal cadence because they are high-value management targets.

What is the CISA remediation deadline?

CISA added CVE-2025-59718 to the Known Exploited Vulnerabilities catalog on 11 December 2025 with a remediation due date of 25 December 2025 for US federal civilian agencies. Private-sector organisations should treat that as a reasonable target given confirmed in-the-wild exploitation.

Need expert help with this?

If your estate runs FortiGate at the perimeter, CVE-2025-59718 is an architecture problem as much as a patch problem. CybernytronX can validate your exposure with a focused external and management-plane penetration test, help you build or tune the SOC detections above, and deploy Ethereon, our AI-assisted threat detection platform, to surface forged-SSO and post-exploitation behaviour in near real time. Talk to us at cybernytronx.com/contact.html.