Description
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| FortiOS | Fortinet / FortiOS | >= 7.0.0, <= 7.0.17 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.2.0, <= 7.2.11 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.4.0, <= 7.4.8 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.6.0, <= 7.6.3 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.0.0, <= 7.0.21 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.2.0, <= 7.2.14 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.4.0, <= 7.4.10 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.6.0, <= 7.6.3 | affected |
| FortiSwitchManager | Fortinet / FortiSwitchManager | >= 7.0.0, <= 7.0.5 | affected |
| FortiSwitchManager | Fortinet / FortiSwitchManager | >= 7.2.0, <= 7.2.6 | affected |
| RUGGEDCOM APE1808 | Siemens / RUGGEDCOM APE1808 | >= 0, < * | affected |