CVE-2025-59718 & CVE-2025-59719 - Fortinet FortiCloud SSO Auth Bypass
CORTEX Protocol Intelligence Assessment
Business Impact: SSO authentication bypass affects entire Fortinet security stack—FortiOS firewalls, FortiWeb WAFs, FortiProxy secure gateways, FortiSwitchManager. Single compromise cascades to all connected products. Auto-enable during registration catches admins unaware—organizations may have SSO active without knowledge. Technical Context: CVE-2025-59718 and CVE-2025-59719 are improper cryptographic signature verification flaws in FortiCloud SSO SAML implementation (T1556.006 Modify Authentication Process: Multi-Factor Authentication). Attackers craft malicious SAML messages to bypass authentication entirely or forge valid tokens. Internally discovered, no exploitation yet, but CVSS 9.8 with authentication bypass means immediate patching critical.
Strategic Intelligence Guidance
- Immediately inventory FortiOS, FortiWeb, FortiProxy and FortiSwitchManager instances, determine whether FortiCloud SSO is enabled, and upgrade to the vendor-recommended fixed versions on an emergency schedule.
- Temporarily disable FortiCloud SSO login wherever feasible and restrict all management interfaces to dedicated admin networks or VPN-only access paths.
- Implement strong authentication and role-based access control for all Fortinet administrative accounts, and enable alerting for unusual login locations, SSO flows, or privilege escalations.
- Review firewall, WAF and proxy configurations for unauthorized changes and ensure that central logging and SIEM collection from Fortinet devices cannot be disabled without detection.