---
title: "FortiCloud SSO SAML Bypass: CVE-2025-59718/59719"
url: https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/
description: "Crafted SAML lets attackers log in as admin on FortiGate, FortiProxy, FortiWeb and FortiSwitchManager with FortiCloud SSO enabled. Exploited; patch."
type: security-brief
section: "Security Digest"
date_published: 2025-12-09
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2025-59718", "CVE-2025-59719"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiCloud SSO SAML Bypass: CVE-2025-59718/59719

**Verdict: Act now.** If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.

- **Who must act:** Owners of FortiGate (FortiOS 7.0-7.6), FortiProxy, FortiWeb 7.4-8.0 or FortiSwitchManager devices that were registered to FortiCare from the GUI without turning off FortiCloud SSO login.
- **Who can relax:** FortiOS 6.4 and FortiWeb 7.2 and older are not affected, and devices where admin-forticloud-sso-login is disabled were not exposed to this bug.
- **Affected:** FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17; FortiProxy 7.6.0-7.6.3, 7.4.0-7.4.10, 7.2.0-7.2.14, 7.0.0-7.0.21; FortiSwitchManager 7.2.0-7.2.6, 7.0.0-7.0.5; FortiWeb 8.0.0, 7.6.0-7.6.4, 7.4.0-7.4.9 (CVE-2025-59719)
- **Fixed:** FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18; FortiProxy 7.6.4, 7.4.11, 7.2.15, 7.0.22; FortiSwitchManager 7.2.7, 7.0.6; FortiWeb 8.0.1, 7.6.5, 7.4.10; Note: CVE-2026-24858 (Jan 2026) requires later builds
- **CVEs:** CVE-2025-59718, CVE-2025-59719
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check whether FortiCloud SSO admin login is on: show system global | grep forticloud-sso.
2. Disable it until patched: config system global / set admin-forticloud-sso-login disable / end.
3. Upgrade to the latest release on your train, which also covers CVE-2026-24858 from January 2026 (FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19 or later).
4. Restrict the management interface to trusted networks with a local-in policy.
5. If you see suspicious SSO logins, treat the config as stolen: reset admin and VPN credentials and any LDAP/AD bind accounts.

### How to check if you are affected

- Search system event logs for logid 0100032001 'Admin login successful' with method="sso" from unfamiliar IPs.
- Look for logid 0100032095 config downloads ('System config file has been downloaded') right after an SSO login.
- Compare against Arctic Wolf's December 2025 IOCs, such as 45.32.153.218, 167.179.76.111, 199.247.7.82 and 38.54.88.203.
- Review the admin account list for entries you did not create.

## What happened

On December 9, 2025, Fortinet published [FG-IR-25-647](https://fortiguard.fortinet.com/psirt/FG-IR-25-647), covering two improper-signature-verification flaws (CWE-347) in the FortiCloud SSO admin login. CVE-2025-59718 affects FortiOS, FortiProxy and FortiSwitchManager. CVE-2025-59719 affects FortiWeb. An unauthenticated attacker could send a crafted SAML message and be logged in as an administrator, because the device did not properly verify the SAML signature. Fortinet's product security team found the issue internally. The vendor scores it CVSS 3.1 9.8 and marks it known exploited.

Exploitation started within days. [Arctic Wolf](https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/) began seeing malicious SSO logins on FortiGate appliances on December 12, 2025. The logins came from a handful of hosting providers, mostly targeted the `admin` account, and were followed by downloads of the device configuration to the same IPs. CISA added CVE-2025-59718 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718) on December 16, 2025, and told agencies to also apply the CVE-2025-59719 patches.

## Who is affected

Affected versions are FortiOS 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8 and 7.6.0-7.6.3, along with the matching FortiProxy and FortiSwitchManager 7.0/7.2 lines ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-59718)), and FortiWeb 7.4.0-7.4.9, 7.6.0-7.6.4 and 8.0.0 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-59719)). FortiOS 6.4 and FortiWeb 7.2 and earlier are not affected.

The key precondition is that the feature must be on. Fortinet says FortiCloud SSO login is off in factory settings. However, registering a device to FortiCare from the GUI turns it on, unless the admin flips off the "Allow administrative login using FortiCloud SSO" toggle on the registration page. Many devices registered through the GUI therefore had it enabled without anyone deciding to turn it on.

## Do you really need to act?

If the toggle was on, yes. This was an unauthenticated admin login on a network edge device, exploited within three days of disclosure. Stolen configurations contain hashed admin credentials, VPN settings and often LDAP bind details, and Arctic Wolf warns that hashes can be cracked offline. If the feature was off on every device, these two CVEs did not expose you. You still need to patch, because the follow-up flaw below targets the same feature.

The story did not end here. In January 2026, Fortinet's [PSIRT blog](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios) reported malicious SSO logins on devices that were fully patched against these CVEs. That became CVE-2026-24858 (FG-IR-26-060), which we cover separately. The December builds alone are not enough.

## What to do now

1. Check the setting on each FortiGate or FortiProxy: `show system global | grep forticloud-sso`.
2. Until patched, disable it: `config system global`, `set admin-forticloud-sso-login disable`, `end`.
3. Upgrade. The FG-IR-25-647 minimums are FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, FortiProxy 7.6.4, 7.4.11, 7.2.15 and 7.0.22, FortiSwitchManager 7.2.7 and 7.0.6, and FortiWeb 8.0.1, 7.6.5 and 7.4.10. Go straight to the January 2026 builds (for example FortiOS 7.6.6, 7.4.11, 7.2.13 or 7.0.19) so you also close CVE-2026-24858.
4. Restrict administrative access with a local-in policy so only management networks can reach HTTPS admin.
5. If you find indicators, restore a known-good config or audit it carefully, and rotate admin, VPN and directory credentials.

## How to tell if you were hit

Search FortiGate system event logs for `logid="0100032001"` ("Admin login successful") with `method="sso"` and a `ui="sso(<ip>)"` from an address you don't recognize. A login like that followed by `logid="0100032095"` ("System config file has been downloaded ... via GUI") is the pattern Arctic Wolf reported. Its IOC list includes 45.32.153.218, 167.179.76.111, 199.247.7.82, 45.61.136.7, 38.54.88.203, 38.54.95.226 and 38.60.212.97. Also review `config system admin` for accounts nobody created.

## Timeline

- Dec 9, 2025 — Fortinet publishes FG-IR-25-647 with fixes.
- Dec 12, 2025 — Arctic Wolf observes malicious FortiCloud SSO logins and config exports.
- Dec 16, 2025 — CISA adds CVE-2025-59718 to KEV (due Dec 23).
- Jan 22, 2026 — Fortinet reports SSO abuse on fully patched devices, which leads to CVE-2026-24858.

## Sources

1. [Fortinet PSIRT — FG-IR-25-647: Improper verification of cryptographic signature in FortiCloud SSO login](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)
2. [NVD — CVE-2025-59718](https://nvd.nist.gov/vuln/detail/CVE-2025-59718)
3. [NVD — CVE-2025-59719](https://nvd.nist.gov/vuln/detail/CVE-2025-59719)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-59718](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718)
5. [Arctic Wolf — Malicious SSO logins on FortiGate devices following disclosure of CVE-2025-59718 and CVE-2025-59719](https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/)
6. [Fortinet PSIRT blog — Analysis of Single Sign-On Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios)

---
Source page: https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt