Is CVE-2025-59718 (Fortinet Multiple Products Improper Verification of Cryptographic Signature) being exploited in the wild?

What “exploited in the wild” means for this Fortinet CVE

For this question, the key point is not just that a flaw exists, but that CISA has already placed CVE-2025-59718 in the KEV catalogue. That is the clearest public signal that defenders should treat it as active exploitation risk, confirm whether exposed Fortinet devices are in scope, and prioritise response as if exploitation is already underway rather than waiting for broader confirmation.

Because the vulnerability is in perimeter and access-facing products, the practical exposure question is simple: any internet-reachable FortiOS, FortiSwitchMaster, FortiProxy, or FortiWeb instance that uses the affected authentication path deserves immediate review. The issue is especially relevant where SAML login is enabled, because a crafted message can change the trust decision at the login boundary.

How the vulnerability creates real attack exposure

The flaw is an improper verification of a cryptographic signature, which means the product may accept a security decision without properly proving that the message was signed by a trusted party. In this case, that can let an unauthenticated attacker bypass FortiCloud SSO login authentication with a crafted SAML message. For defenders, the important detail is not the cryptography in the abstract, but that a trust check at authentication time has failed open.

That failure mode matters because login and federation endpoints are often high-value targets. If an attacker can get past the SSO step, they may gain a foothold without needing stolen credentials, which changes the defensive posture from routine patching to immediate exposure assessment. The CISA Known Exploited Vulnerabilities Catalog is the right place to confirm the active-exploitation status and drive urgency.

What practitioners should do first when they see this CVE

Start by identifying every deployed Fortinet instance that could use SAML login or FortiCloud SSO, then verify whether it is internet-facing, vendor-managed, or part of a shared access boundary. Do not assume that only the primary firewall or proxy is relevant, because the affected product set spans multiple Fortinet platforms and the login path may be distributed across them.

If exposure exists, apply the vendor’s remediation path immediately and treat any delay as a temporary risk acceptance decision, not a neutral waiting period. When the environment cannot be patched at once, narrow access to the management and SSO surfaces, monitor authentication activity closely, and review whether the device can be isolated or taken out of service until the fix is in place. Use the vendor advisory and the NIST National Vulnerability Database for authoritative version and product detail rather than relying on secondary summaries.

Signs of possible compromise and what to check next

Because this is an authentication-bypass issue, the compromise review should focus on successful logins, unfamiliar administrative sessions, configuration changes, and any access that appears to have originated without the expected identity proofing step. Check the period before patching as well, since active exploitation can precede public disclosure and may leave only subtle authentication or configuration traces.

If you find evidence of unauthorized access, treat the device as a potential initial access point and hunt for post-authentication activity, including policy changes, new accounts, altered access rules, or unexpected administrative actions. The CVE record should also be compared with the CVE Program entry and vendor notes so that your incident triage is aligned to the exact affected product family and remediation guidance.

Risk and Threat Considerations

This vulnerability is dangerous because it sits at the trust boundary for authentication, where a single verification failure can convert a crafted message into administrative access. In edge and security appliances, that kind of weakness is attractive to attackers because it can provide direct entry with little noise and can often be reached before downstream monitoring sees anything suspicious.

Failure mechanism: The product accepts a SAML message without properly validating the cryptographic signature, allowing an attacker to impersonate a trusted authentication flow and bypass the FortiCloud SSO login step.

Impact: Unauthenticated access can lead to administrative compromise, policy manipulation, and broader network exposure, especially if the device protects a privileged or internet-facing segment.

Practitioner Guidance

What to prioritise: Prioritise exposed Fortinet appliances that participate in SSO or management access, because those systems combine high privilege with high reach. If you have multiple Fortinet product lines, validate each one separately rather than assuming a single remediation action covers the whole estate.

What to verify: Verify not only whether the vendor fix is applied, but whether there was any successful authentication, configuration drift, or new administrative activity before remediation. If the device cannot produce sufficient logs to support that review, treat logging gaps as part of the incident response problem, not just an observability issue.

Practitioner takeaway: For KEV-listed authentication flaws, the decision is not whether exploitation is theoretically possible, but whether the device was exposed long enough to be treated as potentially compromised and investigated accordingly.

Related resources from NHI Mgmt Group

• Guide: Edge Device Security Guide
• How do you patch or mitigate CVE-2025-59718 (Fortinet Multiple Products Improper Verification of Cryptographic Signature)?
• CVE-2025-59718 (Fortinet Multiple Products Improper Verification of Cryptographic Signature)
• Is CVE-2025-61932 (Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel) being exploited in the wild?
• Is CVE-2023-41991 (Apple Multiple Products Improper Certificate Validation) being exploited in the wild?