Is CVE-2025-59718 being actively exploited?

Yes. CVE-2025-59718 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on December 16, 2025.

What is the CVSS score for CVE-2025-59718?

CVE-2025-59718 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2025-59718

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 68.3%EU EUVD: exploited

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-347
EPSS score: 68.3% (99th percentile)
In CISA KEV: Yes, added December 16, 2025
In EU EUVD: Yes (EUVD-2025-202198)
Published: December 9, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Added to the KEV catalog on December 16, 2025; federal remediation due December 23, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-202198 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 15, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortios
fortinet / fortiproxy
fortinet / fortiswitchmanager
siemens / ruggedcom ape1808
siemens / ruggedcom ape1808 firmware

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Fortinet, Inc. FortiOS 7.0.7 - Fortinet, Inc. - Common Criteria NSCIB-CC-0590233-CR - active

References

https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/(Third Party Advisory)
https://cert-portal.siemens.com/productcert/html/ssa-864900.html(Third Party Advisory)
https://fortiguard.fortinet.com/psirt/FG-IR-25-647(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain