Fortinet Releases Security Advisory for FortiCloud SSO Login Authentication Bypass
The security advisory address two vulnerabilities that could allow an attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message
Summary
The security advisory address two vulnerabilities that could allow an attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message
Affected platforms
The following platforms are known to be affected:
Threat details
Potential exploitation of CVE-2025-59718 and CVE-2025-59719
Researchers have reported evidence of malicious SSO logins on FortiGate devices following disclosure of CVE-2025-59718 and CVE-2025-59719.
Introduction
Fortinet has released a security advisory to address two critical vulnerabilities affecting FortiOS, FortiWeb, FortiProxy and FortiSwitchManager. Devices are only vulnerable if the FortiCloud SSO login feature is enabled when registering the device to FortiCare.
Threat updates
| Date | Update |
|---|---|
| 16 Dec 2025 | Added details regarding potential exploitation of CVE-2025-59718 and CVE-2025-59719 |
Remediation advice
Affected organisations are encouraged to review the Fortinet PSIRT FG-IR-25-647 and apply the relevant updates as soon as possible.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 16 December 2025 12:14 pm