{"id":"CVE-2025-59718","kind":"vulnerability","aliases":["CVE-2025-59718"],"related":[],"title":"A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS…","description":"WAF Release - 2026-03-30 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMarch 30, 2026\n\n## WAF Release - 2026-03-30\n\nThis week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce.\n\nKey Findings\n\n- CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device.\n- Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE).\n\nImpact\n\nSuccessful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...2f7f95e9 | N/A | Generic Rules - Parameter Pollution - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...319731a4 | N/A | Generic Rules - Parameter Pollution - Header - Form | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...def262dd | N/A | Generic Rules - Parameter Pollution - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70a36147 | N/A | Magento 2 - Unrestricted file upload | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...2ffcca9f | N/A | Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718 | Log | Block | This is a new detection. |","summary":"Fortinet FortiOS, FortiSwitchManager, FortiProxy and FortiWeb accept forged SAML messages for FortiCloud SSO login, so the signature check is not enforced. An unauthenticated attacker can log in as an administrator without credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-12-16T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.0.22"],"affected":">= 7.0.0, < 7.0.22","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.2.15"],"affected":">= 7.2.0, < 7.2.15","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.4.11"],"affected":">= 7.4.0, < 7.4.11","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.6.4"],"affected":">= 7.6.0, < 7.6.4","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.0.6"],"affected":">= 7.0.0, < 7.0.6","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.2.7"],"affected":">= 7.2.0, < 7.2.7","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.18"],"affected":">= 7.0.0, < 7.0.18","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.2.12"],"affected":">= 7.2.0, < 7.2.12","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.4.9"],"affected":">= 7.4.0, < 7.4.9","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.6.4"],"affected":">= 7.6.0, < 7.6.4","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","fortinet","fortios","fortiproxy","fortiweb","infrastructure","lab-disclosure","self-hosted"],"not_affected_if":["forticloud-sso-disabled","managed-hosting"],"how_to_check":"Check whether FortiCloud SSO login is enabled on the device (unknown exact CLI command in sources).\nReview admin login logs for unexpected FortiCloud SSO logins.\nCompare firmware version against the Fortinet advisory (versions not stated in sources).","fix":"Apply the patched firmware named in the Fortinet advisory for your product line (versions unknown in sources).\nUntil patched, disable FortiCloud SSO login or discontinue use of the product if no mitigation exists, per CISA guidance.","status":"open","published_at":"2025-12-09T18:15:54+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:44+00:00","updated_at":"2026-10-24T19:12:57+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:42:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the patched firmware named in the Fortinet advisory for your product line (versions unknown in sources).\nUntil patched, disable FortiCloud SSO login or discontinue use of the product if no mitigation exists, per CISA guidance.","reach":"internet","summary":"Fortinet FortiOS, FortiSwitchManager, FortiProxy and FortiWeb accept forged SAML messages for FortiCloud SSO login, so the signature check is not enforced. An unauthenticated attacker can log in as an administrator without credentials.","category":"infrastructure","who_cares":["fortinet","fortios","fortiproxy","fortiweb","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains administrative access to the appliance and its configuration.","analyst_note":"Get exact patched versions and the SSO disable steps from the Fortinet PSIRT advisory linked from the CISA KEV entry for CVE-2025-59718.","how_to_check":"Check whether FortiCloud SSO login is enabled on the device (unknown exact CLI command in sources).\nReview admin login logs for unexpected FortiCloud SSO logins.\nCompare firmware version against the Fortinet advisory (versions not stated in sources).","needs_analyst":true,"not_affected_if":["forticloud-sso-disabled","managed-hosting"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000526,"input_tokens":2652,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-03':96C,112C '-2025':16A,19A,131C,171C,367C '-30':97C,113C '-59718':17A,20A,132C,172C,368C '2':213C,344C '2026':95C,108C,111C '2f7f95e9':289C '2ffcca9f':358C '30':107C '319731a4':306C '7.6.0':11A '7.6.3':13A '70a36147':341C 'accept':67B 'action':282C,284C 'addit':148C 'administr':90B,261C 'adob':166C,223C 'allow':187C,225C,256C 'alongsid':133C 'ape1808':46A 'attack':84B,190C,227C,258C 'attempt':147C 'authent':124C,197C,363C 'block':143C,349C,370C 'bodi':295C 'bypass':125C,192C,229C,364C 'changelog':98C,99C 'check':78B,231C 'cloudflar':48B,105C,286C,303C,321C,338C,355C 'code':243C 'comment':285C 'commerc':167C,224C 'complet':268C 'compromis':270C 'control':262C 'could':255C 'craft':201C 'credenti':92B 'critic':123C,218C 'cryptograph':5A,175C 'cve':15A,18A,130C,170C,365C,366C 'data':272C 'def262dd':324C 'deploy':264C 'descript':280C 'design':139C 'detect':120C,137C,302C,320C,337C,354C,375C 'devic':211C 'disabl':297C,315C,332C 'disclosur':57B 'enabl':208C 'enforc':81B 'execut':244C 'exploit':49B,248C 'featur':206C 'file':160C,215C,235C,346C 'find':169C 'firmware':47A 'flaw':219C 'forg':68B 'form':313C 'forticloud':72B,194C,361C 'fortinet':9A,21A,24A,26A,28A,30A,32A,34A,36A,38A,40A,42A,50B,61B,128C,180C,251C,360C 'fortio':10A,14A,51B,62B,181C 'fortios':37A,39A,41A,43A 'fortiproxi':52B,64B,182C 'fortiproxy':25A,27A,29A,31A 'fortiswitchmanag':63B,184C 'fortiswitchmanager':33A,35A 'fortiweb':53B,66B 'gain':260C 'generic':136C,291C,308C,326C 'header':312C 'high':157C 'high-impact':156C 'host':60B 'http':144C 'id':276C,279C 'identifi':141C 'impact':158C,246C 'improp':2A,174C 'improv':103C 'includ':151C 'infrastructur':54B 'introduc':118C 'key':168C 'lab':56B 'lab-disclosur':55B 'lead':240C,266C 'legaci':277C 'log':86B,296C,314C,331C,348C,369C 'login':74B,196C 'magento':164C,212C,221C,253C,343C 'malici':200C,234C 'manag':287C,304C,322C,339C,356C 'march':106C 'may':186C 'messag':70B,203C 'multiple':22A 'n/a':290C,307C,325C,342C,359C 'new':100C,119C,135C,283C,301C,319C,336C,353C,374C 'paramet':145C,293C,310C,328C 'pollut':146C,294C,311C,329C 'potenti':239C 'previous':281C 'product':129C 'products':23A 'protect':153C 'rce':245C 'releas':94C,110C,117C,150C 'remot':242C 'ruggedcom':45A 'rule':138C,275C,278C,292C,309C,327C 'ruleset':274C,288C,305C,323C,340C,357C 'saml':69B,202C 'secur':230C 'self':59B 'self-host':58B 'server':238C,269C 'siemens':44A 'signatur':6A,77B,176C 'sso':73B,195C,362C 'success':247C 'target':152C 'theft':273C 'three':134C 'unauthent':83B,189C,226C,257C 'unrestrict':159C,214C,345C 'updat':101C 'upload':161C,216C,233C,347C 'uri':330C 'use':198C 'verif':3A,177C 'vulner':7A,126C,162C,178C,254C 'waf':93C,109C 'webshel':265C 'week':115C 'without':91B","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-03-30","covers":"HTTP requests proxied through Cloudflare, matched by the Cloudflare Managed Ruleset rule 'Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718' (action changed from Log to Block)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-03-30-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:12:08Z","confidence":0.85,"source_title":"WAF Release - 2026-03-30 · Changelog","customer_action":"none stated in the document beyond the WAF rule; the document does not say customers can skip patching"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-09T18:15:54+00:00","kev":{"dateAdded":"2025-12-16","dueDate":"2025-12-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-59718","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-59718","severity":null,"published_at":"2025-12-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-59718","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59718","severity":null,"published_at":"2025-12-09T18:15:54+00:00","modified_at":"2026-06-17T09:46:35+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-03-30-waf-release/#CVE-2025-59718","url":"https://developers.cloudflare.com/changelog/post/2026-03-30-waf-release/","severity":null,"published_at":"2026-03-30T19:12:05+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-03-30 · Changelog"}],"documents":[{"id":2923,"url":"https://developers.cloudflare.com/changelog/post/2026-03-30-waf-release/","title":"Cloudflare: WAF Release - 2026-03-30 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-03-30 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMarch 30, 2026\n\n## WAF Release - 2026-03-30\n\nThis week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce.\n\nKey Findings\n\n- CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device.\n- Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE).\n\nImpact\n\nSuccessful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...2f7f95e9 | N/A | Generic Rules - Parameter Pollution - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...319731a4 | N/A | Generic Rules - Parameter Pollution - Header - Form | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...def262dd | N/A | Generic Rules - Parameter Pollution - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70a36147 | N/A | Magento 2 - Unrestricted file upload | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...2ffcca9f | N/A | Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718 | Log | Block | This is a new detection. |","published_at":"2026-03-30T19:12:05+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}