CVE-2025-59718: Fortinet FortiOS/FortiProxy/FortiWeb -- SAML Authentication Bypass

Background

Fortinet products — FortiOS (the OS underlying FortiGate firewalls), FortiProxy (web proxy), FortiSwitchMaster, and FortiWeb (web application firewall) — are among the most widely deployed network security appliances in enterprise environments. Their role at network perimeters and their privileged access to traffic make them prime targets for sophisticated attackers.

CVE-2025-59718 is an improper cryptographic signature verification vulnerability (CWE-347) in the SAML authentication handling for FortiCloud SSO across multiple Fortinet products. By crafting a malicious SAML assertion with a forged or improperly validated signature, an unauthenticated attacker can bypass the FortiCloud SSO authentication mechanism and gain unauthorized access. Note that CVE-2025-59719 addresses the same underlying problem; both CVEs should be remediated together per the Fortinet advisory.

CISA added this to the KEV catalog on 2025-12-16. Fortinet appliance vulnerabilities have been high-priority targets for nation-state groups including those associated with Chinese, Russian, and Iranian cyber operations.

Technical Mechanism

CWE-347 (Improper Verification of Cryptographic Signature) in SAML authentication means the server does not properly validate the XML digital signature on incoming SAML assertions. SAML XML Signature Wrapping (XSW) attacks exploit this by placing a valid signed element in a different position in the XML document than where the application validates it.

<!-- Legitimate SAML response structure (signed) -->
<samlp:Response>
  <saml:Assertion ID="signed_assertion">
    <saml:Subject><saml:NameID>legit_user</saml:NameID></saml:Subject>
    <ds:Signature>...valid signature over signed_assertion...</ds:Signature>
  </saml:Assertion>
</samlp:Response>

<!-- XSW attack: inject unsigned assertion; move signed one to extension -->
<samlp:Response>
  <saml:Assertion ID="attacker_assertion"> <!-- unsigned, processed by app -->
    <saml:Subject><saml:NameID>admin</saml:NameID></saml:Subject>
  </saml:Assertion>
  <samlp:Extensions>
    <saml:Assertion ID="signed_assertion"> <!-- signed, validated by verifier -->
      <saml:Subject><saml:NameID>legit_user</saml:NameID></saml:Subject>
      <ds:Signature>...valid signature...</ds:Signature>
    </saml:Assertion>
  </samlp:Extensions>
</samlp:Response>

The signature verifier validates the legitimate assertion, while the application processes the injected unsigned assertion, granting the attacker admin access.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Fortinet appliances are extensively targeted — prior FortiOS/FortiGate vulnerabilities (CVE-2023-27997, CVE-2024-21762) were rapidly weaponized by nation-state groups including Volt Typhoon and others. Authentication bypass on perimeter security devices provides attackers with direct administrative access to firewall policies, VPN configuration, and network traffic, enabling both espionage and destructive operations.

Impact Assessment

• Unauthenticated access to FortiCloud SSO-protected Fortinet management consoles
• Full administrative control over FortiGate firewall policies and VPN configuration
• Access to network traffic routing and interception capabilities
• Credential harvesting from managed VPN sessions
• Persistent access via creation of backdoor admin accounts

Affected Versions

Remediation Steps

1. Apply all patches referenced in the Fortinet advisory for CVE-2025-59718 AND CVE-2025-59719.
2. If patching is not immediately possible, disable FortiCloud SSO as a temporary mitigation.
3. Review admin access logs for unauthorized access prior to patching.
4. Audit admin accounts for any recently created or modified accounts.
5. Rotate all administrative credentials and API tokens.
6. Restrict management interface access to dedicated management networks.

Detection Guidance

Log Sources: FortiGate/FortiProxy admin logs, SIEM with Fortinet log integration, network proxy logs.

IOCs: SAML assertions with mismatched signed/processed element IDs; admin logins from unexpected IP addresses; configuration changes made outside normal maintenance windows.

Sigma rule:

title: Fortinet SAML Authentication Bypass Attempt CVE-2025-59718
logsource:
  product: fortinet
  service: fortigate
detection:
  selection:
    action: "login"
    method: "saml"
    status: "success"
    src_ip|not_cidr:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  condition: selection
level: critical

Timeline

References

• NVD — CVE-2025-59718
• CISA KEV — CVE-2025-59718
• Fortinet PSIRT Advisory — CVE-2025-59718