Full Report
AL25-019 - Vulnerabilities impacting Fortinet products - FortiCloud SSO Login Authentication Bypass - CVE-2025-59718 and CVE-2025-59719 - Update 2
Analysis Summary
# Vulnerability: Fortinet FortiCloud SSO Authentication Bypass via Improper Cryptographic Signature Validation
## CVE Details
- CVE ID: CVE-2025-59718, CVE-2025-59719 (and related CVE-2026-24858 referenced in Update 2)
- CVSS Score: Not provided in source, but described initially as "critical."
- CWE: CWE-347 (Improper Verification of Cryptographic Signature)
## Affected Systems
- Products: Fortinet products utilizing the FortiCloud SSO Login feature, including FortiAnalyzer, FortiManager, FortiOS, and FortiProxy.
- Versions: Specific vulnerable versions are detailed under the Remediation section for CVE-2026-24858, spanning multiple major branches (7.6, 7.4, 7.2, 7.0).
- Configurations: Devices with the FortiCloud SSO login feature enabled, and specifically impacting all SAML SSO implementations.
## Vulnerability Description
CVE-2025-59718 and CVE-2025-59719 stem from an improper verification of cryptographic signature (CWE-347) within the FortiCloud SSO login authentication mechanism. This flaw allows an unauthenticated attacker to bypass the legitimate authentication process by submitting a specially crafted SAML response message. Update 2 indicates additional flaws (CVE-2026-24858) affecting a broader set of products and versions relating to the same underlying issue.
## Exploitation
- Status: Exploited in the wild (Confirmed by Fortinet as of Update 1).
- Complexity: Implied to be low to medium, given initial reports of exploitation shortly after patch release.
- Attack Vector: Network (Remote exploitation targeting public-facing SAML/SSO endpoints).
## Impact
- Confidentiality: High (Authentication bypass can grant access to sensitive protected resources).
- Integrity: High (Unauthorized access can lead to data manipulation).
- Availability: Medium to High (Successful exploitation could lead to denial of service or system compromise).
## Remediation
### Patches
Organizations must apply patches corresponding to the discovered vulnerabilities across all affected product lines.
**Patches for CVE-2026-24858 (Update 2 Recommendations):**
| Affected product | Vulnerable Range | Solution |
| :--- | :--- | :--- |
| FortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above |
| FortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above |
| FortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above |
| FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming 7.0.16 or above |
| FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above |
| FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above |
| FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.13 or above |
| FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming 7.0.16 or above |
| FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above |
| FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.12 | Upgrade to upcoming 7.2.13 or above |
| FortiOS 7.0 | 7.0.0 through 7.0.18 | Upgrade to upcoming 7.0.19 or above |
| FortiProxy 7.6 | 7.6.0 through 7.6.4 | Upgrade to upcoming 7.6.6 or above |
| FortiProxy 7.4 | 7.4.0 through 7.4.12 | Upgrade to upcoming 7.4.13 or above |
| FortiProxy 7.2 | 7.2 all versions | Migrate to a fixed release |
| FortiProxy 7.0 | 7.0 all versions | Migrate to a fixed release |
**Patches for Initial Vulnerabilities (AL25-019/AV25-821):** (Note: Update 2 implies these patches may be insufficient or superseded for some instances.)
| Affected product | Original Vulnerable Range | Solution (from initial advisory) |
| :--- | :--- | :--- |
| FortiOS | 7.6.0 through 7.6.3 | Upgrade to 7.6.4 or above |
| FortiOS | 7.4.0 through 7.4.8 | Upgrade to 7.4.9 or above |
| FortiOS | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above |
| FortiOS | 7.0.0 through 7.0.17 | Upgrade to 7.0.18 or above |
### Workarounds
Immediate action is highly recommended until patching is complete:
1. **Disable FortiCloud SSO** on all Fortinet devices where the feature is not essential.
2. **Restrict administrative access to SAML devices from the Internet** by blocking external access (e.g., using a local-in policy) and restricting access only to necessary internal IP addresses.
3. Analyze logs according to the IOCs provided by Fortinet.
## Detection
- Indicators of Compromise (IOCs): IOCs have been provided in the relevant Fortinet blog post (reference FG-IR-26-060). Organizations should actively search logs using these indicators.
- Detection methods and tools: Analyze system and authentication logs for anomalous SAML response activity or unexpected successful logins following the application of the vulnerable configuration.
## References
- Vendor Advisories:
- Fortinet PSIRT Advisories (Footnote 1): hXXps://fortiguard.fortinet.com/psirt/FG-IR-25-647
- Fortinet security advisory (AV25-821) (Footnote 2): hXXps://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av25-821
- Fortinet - Administrative FortiCloud SSO authentication bypass (Footnote 10): hXXps://fortiguard.fortinet.com/psirt/FG-IR-26-060
- CVE Details:
- CVE-2025-59718 Detail (Footnote 3): hXXps://nvd.nist.gov/vuln/detail/CVE-2025-59718
- CVE-2025-59719 Detail (Footnote 4): hXXps://nvd.nist.gov/vuln/detail/CVE-2025-59719
- CVE-2026-24858 Detail (Footnote 9): hXXps://nvd.nist.gov/vuln/detail/CVE-2026-24858
- Analysis:
- Analysis of Single Sign-On Abuse on FortiOS (Footnote 7): hXXps://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios