Vulnerability-Lookup

CVE-2025-59719 (GCVE-0-2025-59719)

Vulnerability from cvelistv5 – Published: 2025-12-09 17:20 – Updated: 2026-10-15 01:09

ENISA Previdian

Summary

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-10 04:57 UTC

CWE

CWE-347 - Improper access control

Assigner

fortinet CNA under the mitre root

CNA scorecard C 72/100 over 56 records in the last 180 days details

References

2 references

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-25-647
https://cert-portal.siemens.com/productcert/html/…

Impacted products

2 products

Vendor	Product	Version	CPE status
Fortinet	FortiWeb	Affected: 8.0.0 Affected: 7.6.0 , ≤ 7.6.4 (semver) Affected: 7.4.0 , ≤ 7.4.9 (semver) cpe:2.3:a:fortinet:fortiweb:8.0.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.9:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.8:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.7:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.0:::::::*
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)	guessed

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: b4defc86-d6f1-4ab6-91af-b239d5b017b3

Vulnerability ID: CVE-2025-59719

Status: Confirmed

Status Updated: 2026-01-27 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-01-27

Asserted: 2026-01-27

Scope

Notes: Affected: Fortinet / Fortiweb | Description: An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. | Origin source: CERT-AT | Notes: https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation

Evidence

Type: Csirt Report

Signal: Successful Exploitation

Confidence: 75%

Source: enisa-cnw-kev

Details

Cwes	-
Euvd	EUVD-2025-202191
Notes	https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation
Catalog	ENISA / EU CSIRTs Network (CNW) KEV JSON
Product	Fortiweb
Datereported	2026/01/27
Originsource	CERT-AT
Vendorproject	Fortinet
Exploitationtype	-
Vulnerabilityname	-
Threatactorsexploiting	-

References

Created: 2026-05-21 09:00 UTC | Updated: 2026-05-21 09:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 67d3ff7b-6a1d-4db1-a51a-1c55b2474c71

Vulnerability ID: CVE-2025-59719

Status: Confirmed

Status Updated: 2025-12-16 14:02 UTC

Exploited: Yes

Timestamps

First Seen: 2025-12-16

Asserted: 2025-12-16

Scope

Notes: KEVIntel entry: An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through... | Affected: Fortinet / FortiWeb | CVSS: 9.1 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through...
Vendor	Fortinet
Product	FortiWeb
Added Date	2025-12-16T14:02:50.000Z
Cvss Score	9.1
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-19 12:42 UTC | Updated: 2026-06-19 12:42 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:28.019701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:56:59.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:09:27.957Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "lessThanOrEqual": "7.6.4",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T12:39:05.692Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nUpgrade to FortiProxy version 7.6.4 or above\nUpgrade to FortiProxy version 7.4.11 or above\nUpgrade to FortiProxy version 7.2.15 or above\nUpgrade to FortiProxy version 7.0.22 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above\nUpgrade to FortiWeb version 8.0.1 or above\nUpgrade to FortiWeb version 7.6.5 or above\nUpgrade to FortiWeb version 7.4.10 or above\nFortinet remediated this issue in FortiSASE version 25.3.b and hence customers do not need to perform any action.\nUpgrade to FortiPAM version 1.8.0 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2025-59719",
    "datePublished": "2025-12-09T17:20:11.763Z",
    "dateReserved": "2025-09-19T04:30:39.464Z",
    "dateUpdated": "2026-10-15T01:09:27.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59719",
      "date": "2026-10-14",
      "epss": "0.29224",
      "percentile": "0.98152"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiWeb",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.0.0"
                  },
                  {
                    "lessThanOrEqual": "7.6.4",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.9",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM APE1808",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "87CA4C4B-2701-4DEB-BB36-DBBFBD19D48A",
                    "versionEndIncluding": "7.4.9",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8473958D-E679-4501-8D78-5350FA8FC1FC",
                    "versionEndIncluding": "7.6.4",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6578F992-46E7-422C-A837-5A7F0E966AB6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de verificaci\u00f3n impropia de firma criptogr\u00e1fica en Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 hasta 7.6.4, FortiWeb 7.4.0 hasta 7.4.9 puede permitir a un atacante no autenticado eludir la autenticaci\u00f3n de inicio de sesi\u00f3n de FortiCloud SSO a trav\u00e9s de un mensaje de respuesta SAML manipulado."
          }
        ],
        "id": "CVE-2025-59719",
        "lastModified": "2026-06-17T09:46:35.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59719",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T04:57:28.019701Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-09T18:15:55.150",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-347"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:27:54+00:00",
      "cve": "CVE-2025-59719",
      "id": "CVE-2025-59719",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-59719",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59719.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM APE1808",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-11T12:23:15.462Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59719",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-10T04:57:28.019701Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-09T18:08:58.625Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiWeb",
              "vendor": "Fortinet",
              "versions": [
                {
                  "status": "affected",
                  "version": "8.0.0"
                },
                {
                  "lessThanOrEqual": "7.6.4",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.9",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-347",
                  "description": "Improper access control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-20T12:39:05.692Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647",
              "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nUpgrade to FortiProxy version 7.6.4 or above\nUpgrade to FortiProxy version 7.4.11 or above\nUpgrade to FortiProxy version 7.2.15 or above\nUpgrade to FortiProxy version 7.0.22 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above\nUpgrade to FortiWeb version 8.0.1 or above\nUpgrade to FortiWeb version 7.6.5 or above\nUpgrade to FortiWeb version 7.4.10 or above\nFortinet remediated this issue in FortiSASE version 25.3.b and hence customers do not need to perform any action.\nUpgrade to FortiPAM version 1.8.0 or above"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2025-59719",
        "datePublished": "2025-12-09T17:20:11.763Z",
        "dateReserved": "2025-09-19T04:30:39.464Z",
        "dateUpdated": "2026-08-11T12:23:15.462Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-00171 (CVE-2025-59719)

Vulnerability from fstec – Published: 2026-01-09 – Updated: 2026-01-09 – View on bdu.fstec.ru Exploit exists Yes Fixed

ENISA Previdian

Title

Summary

Уязвимость компонента SAML Response Message Handler операционных систем FortiOS, межсетевого экрана веб-приложений FortiWeb, прокси-сервера для защиты от интернет-атак FortiProxy и локальной платформы управления FortiSwitchManager связана с недостатками механизма проверки криптографической подписи. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие механизмы безопасности путем отправки специально сформированных SAML-запросов

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Yes

Remediation

Software update

CWE

CWE-347 - Некорректная проверка криптографической подписи

Aliases

CVE-2025-59719, FG-IR-25-647

References

1 reference

URL
https://fortiguard.fortinet.com/psirt/FG-IR-25-647

Impacted products

4 products from 1 vendor

Vendors

Fortinet Inc.

Products

FortiOS, FortiProxy, FortiSwitchManager, FortiWeb

Versions

от 7.2.0 до 7.2.11 включительно (FortiOS), от 7.4.0 до 7.4.8 включительно (FortiOS), от 7.0.0 до 7.0.17 включительно (FortiOS), от 7.6.0 до 7.6.3 включительно (FortiOS), от 7.6.0 до 7.6.3 включительно (FortiProxy), от 7.4.0 до 7.4.10 включительно (FortiProxy), от 7.2.0 до 7.2.14 включительно (FortiProxy), от 7.0.0 до 7.0.21 включительно (FortiProxy), от 7.2.0 до 7.2.6 включительно (FortiSwitchManager), от 7.0.0 до 7.0.5 включительно (FortiSwitchManager), 8.0.0 (FortiWeb), от 7.6.0 до 7.6.4 включительно (FortiWeb), от 7.4.0 до 7.4.9 включительно (FortiWeb)

Product types

Operating system, Security device, Security software, Application software, Network software

Mitigations

Использование рекомендаций производителя: https://fortiguard.fortinet.com/psirt/FG-IR-25-647

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fortinet Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 7.2.0 \u0434\u043e 7.2.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.4.0 \u0434\u043e 7.4.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.0.0 \u0434\u043e 7.0.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.6.0 \u0434\u043e 7.6.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.6.0 \u0434\u043e 7.6.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.4.0 \u0434\u043e 7.4.10 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.2.0 \u0434\u043e 7.2.14 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.0.0 \u0434\u043e 7.0.21 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.2.0 \u0434\u043e 7.2.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiSwitchManager), \u043e\u0442 7.0.0 \u0434\u043e 7.0.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiSwitchManager), 8.0.0 (FortiWeb), \u043e\u0442 7.6.0 \u0434\u043e 7.6.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiWeb), \u043e\u0442 7.4.0 \u0434\u043e 7.4.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiWeb)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://fortiguard.fortinet.com/psirt/FG-IR-25-647",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "09.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "09.01.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-00171",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-59719, FG-IR-25-647",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FortiOS, FortiProxy, FortiSwitchManager, FortiWeb",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 SAML Response Message Handler \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS, \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 FortiWeb, \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f FortiSwitchManager, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (CWE-347)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 SAML Response Message Handler \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS, \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 FortiWeb, \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f FortiSwitchManager \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-347",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CERTFR-2025-AVI-1084

Vulnerability from certfr_avis - Published: 2025-12-10 - Updated: 2025-12-10

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur précise que la version 24.2 de FortiSandbox Cloud sera publiée ultérieurement.

Impacted products

Vendor	Product	Description
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.6
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.4
Fortinet	FortiSOAR	FortiSOAR PaaS versions antérieures à 7.5.2
Fortinet	FortiVoice	FortiVoice versions 7.2.x antérieures à 7.2.3
Fortinet	FortiSOAR	FortiSOAR PaaS versions 7.6.x antérieures à 7.6.3
Fortinet	FortiSOAR	FortiSOAR on-premise versions 7.6.x antérieures à 7.6.3
Fortinet	FortiWeb	FortiWeb versions 7.6.x antérieures à 7.6.6
Fortinet	N/A	FortiExtender versions antérieures à 7.4.8
Fortinet	FortiProxy	FortiProxy versions 7.0.x antérieures à 7.0.22
Fortinet	FortiManager	FortiManager versions 7.4.x antérieures à 7.4.3
Fortinet	FortiManager	FortiManager versions antérieures à 7.2.6
Fortinet	FortiSRA	FortiSRA versions antérieures à 1.5.x
Fortinet	FortiSandbox	FortiSandbox versions 5.0.x antérieures à 5.0.3
Fortinet	FortiPortal	FortiPortal versions antérieures à 7.4.6
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.15
Fortinet	FortiSwitch	FortiSwitchManager versions 7.2.x antérieures à 7.2.7
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.9
Fortinet	FortiWeb	FortiWeb versions 7.2.x antérieures à 7.2.12
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.12
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.4.x antérieures à 7.4.3
Fortinet	FortiWeb	FortiWeb versions 8.0.x antérieures à 8.0.2
Fortinet	FortiSandbox	FortiSandbox Cloud versions antérieures à 24.2
Fortinet	N/A	FortiExtender versions 7.6.x antérieures à 7.6.4
Fortinet	FortiOS	FortiOS versions antérieures à 7.0.18
Fortinet	FortiSASE	FortiSASE versions 24.1.x antérieures à 24.1.c
Fortinet	FortiSandbox	FortiSandbox versions 4.x antérieures à 4.4.8
Fortinet	FortiWeb	FortiWeb versions 7.0.x antérieures à 7.0.12
Fortinet	FortiVoice	FortiVoice versions antérieures à 7.0.8
Fortinet	FortiSOAR	FortiSOAR on-premise versions antérieures à 7.5.2
Fortinet	FortiProxy	FortiProxy versions 7.4.x antérieures à 7.4.11
Fortinet	FortiPAM	FortiPAM versions antérieures à 1.5.x
Fortinet	FortiAuthenticator	FortiAuthenticator versions antérieures à 6.6.7
Fortinet	FortiSwitch	FortiSwitchManager versions 7.0.x antérieures à 7.0.6
Fortinet	FortiProxy	FortiProxy versions 7.6.x antérieures à 7.6.4
Fortinet	FortiWeb	FortiWeb versions 7.4.x antérieures à 7.4.11

References

Title

Publication Time

FKIE_CVE-2025-59719

Vulnerability from fkie_nvd - Published: 2025-12-09 18:15 - Updated: 2026-06-17 09:46

ENISA Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-25-647	Vendor Advisory
	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Impacted products

Vendor	Product	Version
fortinet	fortiweb	*
fortinet	fortiweb	*
fortinet	fortiweb	8.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "lessThanOrEqual": "7.6.4",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "RUGGEDCOM APE1808",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87CA4C4B-2701-4DEB-BB36-DBBFBD19D48A",
              "versionEndIncluding": "7.4.9",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8473958D-E679-4501-8D78-5350FA8FC1FC",
              "versionEndIncluding": "7.6.4",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6578F992-46E7-422C-A837-5A7F0E966AB6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de verificaci\u00f3n impropia de firma criptogr\u00e1fica en Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 hasta 7.6.4, FortiWeb 7.4.0 hasta 7.4.9 puede permitir a un atacante no autenticado eludir la autenticaci\u00f3n de inicio de sesi\u00f3n de FortiCloud SSO a trav\u00e9s de un mensaje de respuesta SAML manipulado."
    }
  ],
  "id": "CVE-2025-59719",
  "lastModified": "2026-06-17T09:46:35.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59719",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-10T04:57:28.019701Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-09T18:15:55.150",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}

GCVE-1-2026-0015 (CVE-2026-25815)

Vulnerability from gna-1 – Published: 2026-02-09 09:09 – Updated: 2026-02-09 09:14

ENISA Previdian

Title

Threat actors use FortiCloud SSO bypass to collect LDAP connection passwords

Summary

**CERT.at gained access to a toolkit of an unknown threat actor targeting FortiCloud SSO bypass in Fortinet appliances (CVE-2025-59718/CVE-2025-59719). We are releasing under TLP:CLEAR key findings about likely post-exploitation goals of the attacker.** The obtained exploit works only for the original vulnerability and is not effective against patched devices. It is, however, known that the flaw still exists and affects all SSO setups in Fortinet appliances. The exploit behavior is consistent with our previous publication - https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation) . The exploit is prepared to work against FortiGate instances, and in the toolkit, we have found two scripts for the post-exploitation analysis of the collected configuration dumps. The attacker: * looks for the LDAP/AD configuration settings, * is in the possession of the default FortiGate configuration encryption key. The “regular bind“ mode of LDAP/AD connection with FortiGate requires providing user credentials for the appliance, which FortiGate uses to establish a connection with the LDAP server. They are encrypted in the configuration, but by default, the encryption key is static and the same on all instances. We were able to confirm that the key included in the attacker toolkit works on the fresh FortiGate 7.6.5 VM. **Note:** in our tests, we also confirmed that the normal local user passwords are NOT possible to retrieve back. Our understanding is that only the data that is necessary to become back (LDAP connection password for regular bind, private keys for certificates, etc.) could be decrypted. Preventive recommendations -------------------------- We strongly recommend activating the “private data encryption” feature in FortiGate devices, which replaces the default encryption key. This step is also officially recommended by Fortinet as a hardening measure. The encryption key has to be the same in all instances in an HA cluster. Using a custom encryption key helps “buying time” for credential rotation after a configuration leak. As always, CERT.at strongly recommends keeping management interfaces not accessible from the public internet. In the last blog post, the Fortinet PSIRT recommends setting a local-in policy to restrict access on the administrative interface.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

CWE

CWE-1188 - Insecure Default Initialization of Resource

Assigner

CIRCL GNA GNA-1

GNA scorecard B 90/100 over 243 records in the last 180 days details

References

6 references

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-25-647	vendor-advisory
https://www.fortinet.com/blog/psirt-blogs/analysi…	vendor-advisory
https://docs.fortinet.com/document/fortigate/7.6.…	mitigation
https://community.fortinet.com/t5/FortiGate/Techn…	mitigation
https://docs.fortinet.com/document/fortigate/7.6.…	mitigation
https://docs.fortinet.com/document/fortigate/7.6.…	mitigation

Impacted products

1 product

Vendor	Product	Version
fortinet	fortios	Affected: ≤ 7.6.6

Credits

Kamil Mankowski

Relationships

update GCVE-1-2026-0015 (this record)

related CVE-2025-59718
related CVE-2025-59719
overlap CVE-2026-25815

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: b4defc86-d6f1-4ab6-91af-b239d5b017b3

Vulnerability ID: CVE-2025-59719

Status: Confirmed

Status Updated: 2026-01-27 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-01-27

Asserted: 2026-01-27

Scope

Evidence

Type: Csirt Report

Signal: Successful Exploitation

Confidence: 75%

Source: enisa-cnw-kev

Details

Cwes	-
Euvd	EUVD-2025-202191
Notes	https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation
Catalog	ENISA / EU CSIRTs Network (CNW) KEV JSON
Product	Fortiweb
Datereported	2026/01/27
Originsource	CERT-AT
Vendorproject	Fortinet
Exploitationtype	-
Vulnerabilityname	-
Threatactorsexploiting	-

References

Created: 2026-05-21 09:00 UTC | Updated: 2026-05-21 09:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 67d3ff7b-6a1d-4db1-a51a-1c55b2474c71

Vulnerability ID: CVE-2025-59719

Status: Confirmed

Status Updated: 2025-12-16 14:02 UTC

Exploited: Yes

Timestamps

First Seen: 2025-12-16

Asserted: 2025-12-16

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through...
Vendor	Fortinet
Product	FortiWeb
Added Date	2025-12-16T14:02:50.000Z
Cvss Score	9.1
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-19 12:42 UTC | Updated: 2026-06-19 12:42 UTC

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "fortios",
          "vendor": "fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.6",
              "status": "affected"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kamil Mankowski"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e**CERT.at gained access to a toolkit of an unknown threat actor targeting FortiCloud SSO bypass in Fortinet appliances (CVE-2025-59718/CVE-2025-59719). We are releasing under TLP:CLEAR key findings about likely post-exploitation goals of the attacker.**\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eThe obtained exploit works only for the original vulnerability and is not effective against patched devices. It is, however, known that the flaw still exists and affects all SSO setups in Fortinet appliances. The exploit behavior is consistent with our previous publication -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation)\"\u003ehttps://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003eThe exploit is prepared to work against FortiGate instances, and in the toolkit, we have found two scripts for the post-exploitation analysis of the collected configuration dumps. The attacker:\u003cbr\u003e\u003cbr\u003e*   looks for the LDAP/AD configuration settings,\u003cbr\u003e*   is in the possession of the default FortiGate configuration encryption key.\u003cbr\u003e\u003cbr\u003eThe \u201cregular bind\u201c mode of LDAP/AD connection with FortiGate requires providing user credentials for the appliance, which FortiGate uses to establish a connection with the LDAP server. They are encrypted in the configuration, but by default, the encryption key is static and the same on all instances. We were able to confirm that the key included in the attacker toolkit works on the fresh FortiGate 7.6.5 VM.\u003cbr\u003e\u003cbr\u003e**Note:** in our tests, we also confirmed that the normal local user passwords are NOT possible to retrieve back. Our understanding is that only the data that is necessary to become back (LDAP connection password for regular bind, private keys for certificates, etc.) could be decrypted.\u003cbr\u003e\u003cbr\u003ePreventive recommendations\u003cbr\u003e--------------------------\u003cbr\u003e\u003cbr\u003eWe strongly recommend activating the \u201cprivate data encryption\u201d feature in FortiGate devices, which replaces the default encryption key. This step is also officially recommended by Fortinet as a hardening measure. The encryption key has to be the same in all instances in an HA cluster. Using a custom encryption key helps \u201cbuying time\u201d for credential rotation after a configuration leak.\u003cbr\u003e\u003cbr\u003eAs always, CERT.at strongly recommends keeping management interfaces not accessible from the public internet. In the last blog post, the Fortinet PSIRT recommends setting a local-in policy to restrict access on the administrative interface.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "**CERT.at gained access to a toolkit of an unknown threat actor targeting FortiCloud SSO bypass in Fortinet appliances (CVE-2025-59718/CVE-2025-59719). We are releasing under TLP:CLEAR key findings about likely post-exploitation goals of the attacker.**\n\n\n\n\nThe obtained exploit works only for the original vulnerability and is not effective against patched devices. It is, however, known that the flaw still exists and affects all SSO setups in Fortinet appliances. The exploit behavior is consistent with our previous publication -\u00a0 https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation) .\n\nThe exploit is prepared to work against FortiGate instances, and in the toolkit, we have found two scripts for the post-exploitation analysis of the collected configuration dumps. The attacker:\n\n*   looks for the LDAP/AD configuration settings,\n*   is in the possession of the default FortiGate configuration encryption key.\n\nThe \u201cregular bind\u201c mode of LDAP/AD connection with FortiGate requires providing user credentials for the appliance, which FortiGate uses to establish a connection with the LDAP server. They are encrypted in the configuration, but by default, the encryption key is static and the same on all instances. We were able to confirm that the key included in the attacker toolkit works on the fresh FortiGate 7.6.5 VM.\n\n**Note:** in our tests, we also confirmed that the normal local user passwords are NOT possible to retrieve back. Our understanding is that only the data that is necessary to become back (LDAP connection password for regular bind, private keys for certificates, etc.) could be decrypted.\n\nPreventive recommendations\n--------------------------\n\nWe strongly recommend activating the \u201cprivate data encryption\u201d feature in FortiGate devices, which replaces the default encryption key. This step is also officially recommended by Fortinet as a hardening measure. The encryption key has to be the same in all instances in an HA cluster. Using a custom encryption key helps \u201cbuying time\u201d for credential rotation after a configuration leak.\n\nAs always, CERT.at strongly recommends keeping management interfaces not accessible from the public internet. In the last blog post, the Fortinet PSIRT recommends setting a local-in policy to restrict access on the administrative interface."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-70",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-70 Try Common or Default Usernames and Passwords"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188 Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/102264/configuring-an-ldap-server"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-private-data-encryption-feature-on-a/ta-p/339071"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://docs.fortinet.com/document/fortigate/7.6.0/best-practices/555436/hardening#SecurePassStorage"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/363127/local-in-policy"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Threat actors use FortiCloud SSO bypass to collect LDAP connection passwords",
      "x_gcve": [
        {
          "recordType": "update",
          "relationships": [
            {
              "destId": "CVE-2025-59718",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-25815",
              "type": "overlap"
            }
          ],
          "vulnId": "GCVE-1-2026-0015"
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0015"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-25815",
    "datePublished": "2026-02-09T09:09:00.000Z",
    "dateUpdated": "2026-02-09T09:14:59.004089Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-0015",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-02-09T09:09:48.357212Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-02-09T09:10:53.252394Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-02-09T09:11:41.464605Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-02-09T09:14:59.004089Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-CHQ4-235Q-JP7W

Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-06-09 12:32

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-59719"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T18:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.",
  "id": "GHSA-chq4-235q-jp7w",
  "modified": "2026-06-09T12:32:00Z",
  "published": "2025-12-09T18:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59719"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-25-135-01

Vulnerability from csaf_cisa - Published: 2025-05-13 00:00 - Updated: 2026-07-09 06:00

Summary

Siemens RUGGEDCOM APE1808 Devices

Scope

22 vulnerabilities in this advisory, including CVE-2025-59719.

CVE-2025-59719

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

NCSC-2025-0386

Vulnerability from csaf_ncscnl - Published: 2025-12-10 09:51 - Updated: 2026-01-28 15:46

Summary

Kwetsbaarheden verholpen in Fortinet producten

Scope

6 vulnerabilities in this advisory, including CVE-2025-59719.

CVE-2025-59719

A vulnerability in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager allows unauthenticated attackers to bypass FortiCloud SSO login authentication via crafted SAML messages.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Known affected: 4 products

Open the full advisory

SSA-864900

Vulnerability from csaf_siemens - Published: 2025-05-13 00:00 - Updated: 2026-10-13 00:00

Summary

SSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices

Scope

29 vulnerabilities in this advisory, including CVE-2025-59719.

CVE-2025-59719

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

WID-SEC-W-2025-2795

Vulnerability from csaf_certbund - Published: 2025-12-09 23:00 - Updated: 2026-01-22 23:00

Summary

Fortinet FortiOS, FortiProxy, FortiSwitch und FortiWeb: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Kritisch

Scope

2 vulnerabilities in this advisory, including CVE-2025-59719.

CVE-2025-59719

Known affected: 13 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-59719 (GCVE-0-2025-59719)

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Csirt Report Successful Exploitation Confidence: 75% Source: enisa-cnw-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

BDU:2026-00171 (CVE-2025-59719)

CERTFR-2025-AVI-1084

Solutions

FKIE_CVE-2025-59719

GCVE-1-2026-0015 (CVE-2026-25815)

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Csirt Report Successful Exploitation Confidence: 75% Source: enisa-cnw-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

GHSA-CHQ4-235Q-JP7W

ICSA-25-135-01

NCSC-2025-0386

SSA-864900

WID-SEC-W-2025-2795

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour