FortiSwitchManager - Privilege Escalation (CVE-2025-59718)
No observed exploitation or insufficient data
Monitor. Low priority for immediate action.
Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
psychologyCrowdSec Analysis
CVE-2025-59718 is a critical vulnerability in multiple Fortinet products, including FortiOS, FortiProxy, and FortiSwitchManager, that stems from improper verification of cryptographic signatures. This flaw allows unauthenticated attackers to bypass FortiCloud SSO login authentication by submitting a crafted SAML response, potentially granting unauthorized access to sensitive systems and data. Attackers exploiting this vulnerability could compromise network security, escalate privileges, and perform further malicious actions within affected environments.
CrowdSec has been tracking this vulnerability and its exploits since 17th of December 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-59718 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending crafted SAMLResponse values via POST requests to the /remote/saml/login endpoint, attempting to bypass FortiCloud SSO authentication and gain administrative access.
Exploitation Timeline
groupSignals collected from the CrowdSec community network.
| Event | Date |
|---|---|
| CVE Published | 2025-12-09 |
| CISA KEV | 2025-12-16 |
| Rule Released | 2025-12-17 |
| CrowdSec First Seen | 2025-12-18 |
| CISA Remediation Deadline | 2025-12-23 |
Active Attackers
Unique IPs observed exploiting this CVE in the last 14 days.
Related Weaknesses
Remediation & Protection
codeAPI Access
Retrieve full intelligence data for CVE-2025-59718