Fortinet has disclosed two critical authentication bypass vulnerabilities in its FortiCloud SSO login feature. Both carry a CVSS score of 9.8, signaling near-maximum severity. Read this Cybersecurity Threat Advisory for more details on how to secure your network infrastructure.
What is the threat?
The first flaw, CVE‑2025‑59718 affects FortiOS, FortiProxy, and FortiSwitchManager. The second flaw, CVE‑2025‑59719 affects FortiWeb. These stem from improper cryptographic signature verification in FortiCloud SSO. Under certain conditions, Fortinet devices fail to validate SAML messages correctly, allowing attackers to submit maliciously crafted messages that appear legitimate.
Why is it noteworthy?
A CVSS score of 9.8 indicates an extremely high risk. Successful exploitation of these flaws could enable attackers to:
- Bypass FortiCloud SSO authentication
- Gain administrative access to Fortinet appliances
- Escalate privileges and alter configurations
- Move laterally across networks using compromised devices
Important: FortiCloud SSO login is disabled by default, but it becomes active when devices are registered to FortiCare and the option “Allow administrative login using FortiCloud SSO” remains enabled.
What is the exposure or risk?
The following organizations are exposed if they:
- Use Fortinet devices with FortiCloud SSO enabled
- Operate multi-tenant environments where FortiCloud SSO is used for centralized authentication
- Have registered devices to FortiCare without disabling the FortiCloud SSO login option
What are the recommendations?
Barracuda strongly recommends the following actions to secure your network infrastructure:
- Update FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager as soon as fixes are available.
- Disable FortiCloud SSO Login: Until patching is complete, turn off this feature as recommended by Fortinet and SANS Institute.
- Disable the “Allow administrative login using FortiCloud SSO” option if not required.
- Apply multi-factor authentication and strict permissions across all Fortinet devices.
References
For more in-depth information about the recommendations, please visit the following links:
- https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-forticloud-sso-login-auth-bypass-flaws/
- https://www.securityweek.com/fortinet-patches-critical-authentication-bypass-vulnerabilities/
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.