erroneo.us
Search all guides⌘K

Security Digest · Dec 9, 2025 · Vulnerability · Network edge

FortiCloud SSO SAML Bypass: CVE-2025-59718/59719

Crafted SAML lets attackers log in as admin on FortiGate, FortiProxy, FortiWeb and FortiSwitchManager with FortiCloud SSO enabled. Exploited; patch.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Act now

If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.

Who must act: Owners of FortiGate (FortiOS 7.0-7.6), FortiProxy, FortiWeb 7.4-8.0 or FortiSwitchManager devices that were registered to FortiCare from the GUI without turning off FortiCloud SSO login.

Who can relax: FortiOS 6.4 and FortiWeb 7.2 and older are not affected, and devices where admin-forticloud-sso-login is disabled were not exposed to this bug.

Affected
FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17
FortiProxy 7.6.0-7.6.3, 7.4.0-7.4.10, 7.2.0-7.2.14, 7.0.0-7.0.21
FortiSwitchManager 7.2.0-7.2.6, 7.0.0-7.0.5
FortiWeb 8.0.0, 7.6.0-7.6.4, 7.4.0-7.4.9 (CVE-2025-59719)
Fixed in
FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18
FortiProxy 7.6.4, 7.4.11, 7.2.15, 7.0.22
FortiSwitchManager 7.2.7, 7.0.6
FortiWeb 8.0.1, 7.6.5, 7.4.10
Note: CVE-2026-24858 (Jan 2026) requires later builds
CVSS
9.8 (v3.1, vendor)
EPSS
68.3% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check whether FortiCloud SSO admin login is on: show system global | grep forticloud-sso.
  2. Disable it until patched: config system global / set admin-forticloud-sso-login disable / end.
  3. Upgrade to the latest release on your train, which also covers CVE-2026-24858 from January 2026 (FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19 or later).
  4. Restrict the management interface to trusted networks with a local-in policy.
  5. If you see suspicious SSO logins, treat the config as stolen: reset admin and VPN credentials and any LDAP/AD bind accounts.

How to check if you are affected or compromised

  • Search system event logs for logid 0100032001 'Admin login successful' with method="sso" from unfamiliar IPs.
  • Look for logid 0100032095 config downloads ('System config file has been downloaded') right after an SSO login.
  • Compare against Arctic Wolf's December 2025 IOCs, such as 45.32.153.218, 167.179.76.111, 199.247.7.82 and 38.54.88.203.
  • Review the admin account list for entries you did not create.

What happened#

On December 9, 2025, Fortinet published FG-IR-25-647, covering two improper-signature-verification flaws (CWE-347) in the FortiCloud SSO admin login. CVE-2025-59718 affects FortiOS, FortiProxy and FortiSwitchManager. CVE-2025-59719 affects FortiWeb. An unauthenticated attacker could send a crafted SAML message and be logged in as an administrator, because the device did not properly verify the SAML signature. Fortinet's product security team found the issue internally. The vendor scores it CVSS 3.1 9.8 and marks it known exploited.

Exploitation started within days. Arctic Wolf began seeing malicious SSO logins on FortiGate appliances on December 12, 2025. The logins came from a handful of hosting providers, mostly targeted the admin account, and were followed by downloads of the device configuration to the same IPs. CISA added CVE-2025-59718 to the KEV catalog on December 16, 2025, and told agencies to also apply the CVE-2025-59719 patches.

Who is affected#

Affected versions are FortiOS 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8 and 7.6.0-7.6.3, along with the matching FortiProxy and FortiSwitchManager 7.0/7.2 lines (NVD), and FortiWeb 7.4.0-7.4.9, 7.6.0-7.6.4 and 8.0.0 (NVD). FortiOS 6.4 and FortiWeb 7.2 and earlier are not affected.

The key precondition is that the feature must be on. Fortinet says FortiCloud SSO login is off in factory settings. However, registering a device to FortiCare from the GUI turns it on, unless the admin flips off the "Allow administrative login using FortiCloud SSO" toggle on the registration page. Many devices registered through the GUI therefore had it enabled without anyone deciding to turn it on.

Do you really need to act?#

If the toggle was on, yes. This was an unauthenticated admin login on a network edge device, exploited within three days of disclosure. Stolen configurations contain hashed admin credentials, VPN settings and often LDAP bind details, and Arctic Wolf warns that hashes can be cracked offline. If the feature was off on every device, these two CVEs did not expose you. You still need to patch, because the follow-up flaw below targets the same feature.

The story did not end here. In January 2026, Fortinet's PSIRT blog reported malicious SSO logins on devices that were fully patched against these CVEs. That became CVE-2026-24858 (FG-IR-26-060), which we cover separately. The December builds alone are not enough.

What to do now#

  1. Check the setting on each FortiGate or FortiProxy: show system global | grep forticloud-sso.
  2. Until patched, disable it: config system global, set admin-forticloud-sso-login disable, end.
  3. Upgrade. The FG-IR-25-647 minimums are FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, FortiProxy 7.6.4, 7.4.11, 7.2.15 and 7.0.22, FortiSwitchManager 7.2.7 and 7.0.6, and FortiWeb 8.0.1, 7.6.5 and 7.4.10. Go straight to the January 2026 builds (for example FortiOS 7.6.6, 7.4.11, 7.2.13 or 7.0.19) so you also close CVE-2026-24858.
  4. Restrict administrative access with a local-in policy so only management networks can reach HTTPS admin.
  5. If you find indicators, restore a known-good config or audit it carefully, and rotate admin, VPN and directory credentials.

How to tell if you were hit#

Search FortiGate system event logs for logid="0100032001" ("Admin login successful") with method="sso" and a ui="sso(<ip>)" from an address you don't recognize. A login like that followed by logid="0100032095" ("System config file has been downloaded ... via GUI") is the pattern Arctic Wolf reported. Its IOC list includes 45.32.153.218, 167.179.76.111, 199.247.7.82, 45.61.136.7, 38.54.88.203, 38.54.95.226 and 38.60.212.97. Also review config system admin for accounts nobody created.

Timeline#

  • — Fortinet publishes FG-IR-25-647 with fixes.
  • — Arctic Wolf observes malicious FortiCloud SSO logins and config exports.
  • — CISA adds CVE-2025-59718 to KEV (due Dec 23).
  • — Fortinet reports SSO abuse on fully patched devices, which leads to CVE-2026-24858.

Vulnerability records

  • CVE-2025-59718 · KEV 2025-12-16 · A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through…
  • CVE-2025-59719 · An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Fortinet PSIRT — FG-IR-25-647: Improper verification of cryptographic signature in FortiCloud SSO login fortiguard.fortinet.com
  2. NVD — CVE-2025-59718 nvd.nist.gov
  3. NVD — CVE-2025-59719 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-59718 cisa.gov
  5. Arctic Wolf — Malicious SSO logins on FortiGate devices following disclosure of CVE-2025-59718 and CVE-2025-59719 arcticwolf.com
  6. Fortinet PSIRT blog — Analysis of Single Sign-On Abuse on FortiOS fortinet.com