CVE-2025-59718
CRITICAL KEVFortinet FortiOS/FortiProxy/FortiSwitchManager SAML Signature Verification Bypass
Title source: llmExploitation Summary
CVE-2025-59718 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 16, 2025. EIP tracks 3 public exploits from researchers including exfil0, adminlove520, moften.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2025-59718, an authentication bypass vulnerability in Fortinet products due to improper SAML signature verification. The exploit crafts unsigned SAML responses to gain administrative access and includes features for bulk scanning, proxy support, and post-authentication actions.
Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Exploits (3)
This repository contains a functional proof-of-concept exploit for CVE-2025-59718, an authentication bypass vulnerability in Fortinet products due to improper SAML signature verification. The exploit crafts unsigned SAML responses to gain administrative access and includes features for bulk scanning, proxy support, and post-authentication actions.
This repository contains a functional Python exploit for CVE-2025-59718, an authentication bypass vulnerability in Fortinet products (FortiOS, FortiProxy, FortiSwitchManager) due to improper SAML signature verification. The exploit crafts unsigned SAML responses to gain administrative access and supports features like multi-threading, proxy usage, and post-authentication actions.
This repository contains a Python-based scanner for detecting vulnerabilities CVE-2025-59718 and CVE-2025-59719 in Fortinet devices (FortiOS, FortiProxy, FortiSwitchManager, FortiWeb). It supports passive fingerprinting, active non-destructive tests, and authenticated SSH checks.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H