PerimeterClock

Patch-to-exploitation timelines for edge appliances (Fortinet, SonicWall, Ivanti), with detection rules.

CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Vendor: Fortinet
Product: Multiple Products
EPSS: 0.683 (99.3th percentile, 2026-10-30)

Summary

FortiOS, FortiSwitchManager, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2025-12-16.

Reviewed by PerimeterClock.

Timeline

Date Event Source
2025-12-16 Added to CISA KEV (confirmed exploitation) CISA KEV

References

Affected and fixed versions: see the vendor advisory or NVD entry below.