{"id":"CVE-2025-59719","published":"2025-12-09T17:20:11Z","modified":"2026-10-15T01:09:27Z","title":"An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through…","vendor":"Fortinet","product":"FortiWeb","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiWeb","versions":["8.0.0",">= 7.6.0, <= 7.6.4",">= 7.4.0, <= 7.4.9"]}],"description":{"text":"An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an improper verification of cryptographic signatures in Fortinet FortiWeb (versions 8.0.0, 7.6.0 through 7.6.4, and 7.4.0 through 7.4.9), affecting the FortiCloud SSO login authentication path. An unauthenticated attacker over the network, with no user interaction and no special configuration beyond the FortiCloud SSO login being in use, could bypass that authentication by sending a crafted SAML response message.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:47Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.29224,"percentile":0.98168,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-15","exploitedFirstSeen":"2025-12-15","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/","date":"2025-12-15"},{"url":"https://www.linkedin.com/posts/drayagha_for-the-latest-fortigate-cves-cve-2025-59718-activity-7407214356226281473-K0vf/","date":"2025-12-17"},{"url":"https://blog.talosintelligence.com/adios-2025-you-wont-be-missed/","date":"2025-12-18"},{"url":"https://www.recordedfuture.com/blog/december-2025-cve-landscape","date":"2026-01-13"},{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-configuration-changes-fortinet-fortigate-devices-via-sso-accounts/","date":"2026-01-21"},{"url":"https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords","date":"2026-01-27"},{"url":"https://www.sentinelone.com/blog/fortigate-edge-intrusions/","date":"2026-03-10"},{"url":"https://blackpointcyber.com/wp-content/uploads/2026/04/2026-Annual-Threat-Report-Blackpoint-Cyber.pdf","date":"2026-04-07"},{"url":"https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/edge-under-siege-how-state-sponsored-actors-exploit-your-perimeter","date":"2026-04-20"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2026/07/08/fortibleed-fortigate-credential-reuse-internet-exposed","date":"2026-07-08"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":27,"pulses":[{"name":"PEERSTITCH, a Stealthy FortiGate Implant","url":"https://otx.alienvault.com/pulse/6ad1a78e61d0627f32255325","created":"2026-10-16"},{"name":"PEERSTITCH, a Stealthy FortiGate Implant","url":"https://otx.alienvault.com/pulse/6ad0096119a185c9dcb055b0","created":"2026-10-14"},{"name":"Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant","url":"https://otx.alienvault.com/pulse/6ad0087b45c45842ef36d6ff","created":"2026-10-14"},{"name":"Actief misbruik kwetsbaarheden Fortinet producten [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6cfe744859afce3a42acd1","created":"2026-07-31"},{"name":"Operation Storming Tide: A massive multi-stage intrusion campaign","url":"https://otx.alienvault.com/pulse/69c963611d2205a97d1f9405","created":"2026-03-29"},{"name":"EbeeMar2026 Pt4","url":"https://otx.alienvault.com/pulse/69bbbb60a8390fc9a5e0e715","created":"2026-03-19"},{"name":"EbeeMar2026 Pt3","url":"https://otx.alienvault.com/pulse/69bbba3ed3b01bcf222ccc1d","created":"2026-03-19"},{"name":"Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise","url":"https://otx.alienvault.com/pulse/69b9c79c3f0550b76fd07367","created":"2026-03-17"},{"name":"Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise","url":"https://otx.alienvault.com/pulse/69b14da61bf814f470228146","created":"2026-03-11"},{"name":"Attackers Exploit FortiGate Edge Devices to Breach Enterprise Networks","url":"https://otx.alienvault.com/pulse/69b0bc8d6c219cb8f9e178d2","created":"2026-03-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-647","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-864900.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-202191","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202191","exploited":true,"exploitedSince":"2026-01-27","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-12-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-59719","provenance":"source"},{"date":"2025-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/","provenance":"source"},{"date":"2026-01-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202191","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 319 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.63,"detail":"percentile 0.9817"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"27 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}