VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 04:58 UTC
← Dashboard

CVE-2025-59718

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 thr…

Read full description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS 9.1 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.1: +1.36
  • Fresh EPSS: 68.29%: +0.34

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Rapid7
Press · 08 Apr 2026, 07:00 · Investigating FortiGate CVE-2025-59718 Exploitation: IR Tales from The Field - Rapid7
Rescana
Press · 11 Mar 2026, 07:00 · FortiGate FortiCloud SSO Authentication Bypass: Active Exploitation of CVE-2025-59718/59719 for Credential Theft and Network Breach - Rescana
The Hacker News
Press · 10 Mar 2026, 07:00 · FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials - The Hacker News
SecurityWeek
Press · 28 Jan 2026, 08:00 · Fortinet Patches Exploited FortiCloud SSO Authentication Bypass - SecurityWeek
The Register
Press · 28 Jan 2026, 08:00 · Fortinet SSO patch bypass gets a separate critical CVE - The Register
See all 25 source documents
Dark Reading
Press · 28 Jan 2026, 08:00 · Fortinet Confirms New Zero-Day Behind Malicious SSO Logins - Dark Reading
Security Affairs
Press · 28 Jan 2026, 08:00 · Fortinet patches actively exploited FortiOS SSO auth bypass (CVE-2026-24858) - Security Affairs
CyberScoop
Press · 28 Jan 2026, 08:00 · Fortinet’s latest zero-day vulnerability carries frustrating familiarities for customers - CyberScoop
Help Net Security
Press · 28 Jan 2026, 08:00 · Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858) - Help Net Security
CyberSecurityNews
Press · 23 Jan 2026, 08:00 · Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass Vulnerability - CyberSecurityNews
The Hacker News
Press · 23 Jan 2026, 08:00 · Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls - The Hacker News
The Hacker News
Press · 22 Jan 2026, 08:00 · Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations - The Hacker News
Arctic Wolf
Press · 21 Jan 2026, 08:00 · Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts - Arctic Wolf
Help Net Security
Press · 21 Jan 2026, 08:00 · Fully patched FortiGate firewalls are getting compromised via CVE-2025-59718? - Help Net Security
BleepingComputer
Press · 21 Jan 2026, 08:00 · Fortinet admins report patched FortiGate firewalls getting hacked - BleepingComputer
BleepingComputer
Press · 19 Dec 2025, 08:00 · Over 25,000 FortiCloud SSO devices exposed to remote attacks - BleepingComputer
Help Net Security
Press · 17 Dec 2025, 08:00 · Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718) - Help Net Security
Rapid7
Press · 17 Dec 2025, 08:00 · Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719 exploited in the wild - Rapid7
BleepingComputer
Press · 16 Dec 2025, 08:00 · Hackers exploit newly patched Fortinet auth bypass flaws - BleepingComputer
The Hacker News
Press · 16 Dec 2025, 08:00 · Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass - The Hacker News
Security Affairs
Press · 16 Dec 2025, 08:00 · Hackers are exploiting critical Fortinet flaws days after patch release - Security Affairs
CyberSecurityNews
Press · 16 Dec 2025, 08:00 · Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild - CyberSecurityNews
Arctic Wolf
Press · 12 Dec 2025, 08:00 · Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719 - Arctic Wolf
SecurityWeek
Press · 10 Dec 2025, 08:00 · Fortinet Patches Critical Authentication Bypass Vulnerabilities - SecurityWeek
Arctic Wolf
Press · 09 Dec 2025, 08:00 · CVE-2025-59718 and CVE-2025-59719: FortiCloud SSO Login Authentication Bypass - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
exfil0/CVE-2025-59718-PoC65Python22 Dec 2025, 17:28
moften/CVE-2025-59718-Fortinet-Poc30Python27 Dec 2025, 04:34
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.1; EPSS 68.3%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:43.394995+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
09 Dec 2025, 08:00
Published
09 Dec 2025, 17:20
Added to the CISA KEV catalog
16 Dec 2025, 00:00
Latest press mention
08 Apr 2026, 07:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar