Fortinet Signature Verification Flaw Added to CISA KEV Catalog: What…

The Cybersecurity and Infrastructure Security Agency (CISA) has escalated the urgency surrounding a critical Fortinet vulnerability by adding CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog. This move signals that threat is not just theoretical—malicious actors are actively leveraging this flaw in real-world attacks. The vulnerability, which centers on improper signature verification in FortiCloud single sign-on (SSO) authentication, affects a range of Fortinet products and poses a direct risk to enterprises, government agencies, and any organization relying on Fortinet’s security infrastructure.

Understanding CVE-2025-59718: A Deep Dive

CVE-2025-59718 is a signature verification bypass vulnerability that allows attackers to forge authentication tokens and gain unauthorized access to protected systems. In essence, the flaw undermines the trust mechanism that verifies the authenticity of digital signatures used in SSO processes. When exploited, it can lead to full account takeover, data breaches, and lateral movement across networks.

How the Exploit Works

Attackers manipulate the signature validation process by crafting malicious tokens that appear legitimate. Because the system fails to properly verify cryptographic signatures, these tokens are accepted, granting the attacker the same privileges as a legitimate user. This type of attack is particularly dangerous in cloud and hybrid environments where SSO is widely used for centralized access management.

For example, an attacker could use this vulnerability to access sensitive customer data, internal communications, or even critical infrastructure controls if Fortinet products are deployed in operational technology (OT) settings. The relative ease of exploitation—coupled with the high impact—makes this one of the most severe vulnerabilities disclosed in recent months.

Affected Products and Versions

The flaw impacts multiple Fortinet products, including FortiGate firewalls, FortiWeb web application firewalls, and FortiADC load balancers. Specifically, versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 are confirmed vulnerable. Organizations using these versions should prioritize patching or mitigation.

• FortiGate 7.4.0–7.4.3
• FortiWeb 7.2.0–7.2.4
• FortiADC 7.2.0–7.2.3
• FortiAuthenticator 7.2.0–7.2.2

It’s worth noting that earlier versions may also be susceptible if custom configurations or outdated modules are in use. A full asset inventory is recommended to identify all potentially affected systems.

Why CISA’s KEV Listing Matters

CISA’s Known Exploited Vulnerabilities catalog isn’t just a list—it’s a directive. Federal agencies are required to remediate listed vulnerabilities within specified timeframes, and private sector organizations are strongly encouraged to follow suit. Adding CVE-2025-59718 to the KEV underscores the immediacy of the threat and the vulnerability’s attractiveness to cybercriminals.

“When CISA adds a CVE to the KEV, it’s because we have reliable evidence that malicious cyber actors are using it to compromise systems. Organizations should treat these with the highest priority.” — CISA Director

This isn’t the first time Fortinet has faced such scrutiny. In 2023, multiple FortiOS vulnerabilities were similarly flagged, leading to widespread patching efforts. The recurrence of critical flaws in widely deployed enterprise security products highlights the challenges vendors face in maintaining complex codebases under increasing attack sophistication.

Mitigation and Patching Strategies

Fortinet has released patches for all affected products. Organizations should apply these updates immediately. If patching isn’t feasible in the short term, consider implementing the following temporary mitigations:

• Disable FortiCloud SSO authentication if it’s not essential for operations.
• Enforce network segmentation to limit the blast radius of a potential breach.
• Monitor authentication logs for anomalous token usage or unexpected SSO attempts.

It’s also advisable to conduct a threat hunt across your environment if you’ve been using vulnerable versions. Look for signs of compromised accounts, unusual login times, or access from unfamiliar geolocations.

Step-by-Step Patching Guide

1. Identify all instances of affected Fortinet products in your inventory.
2. Download the latest firmware or software updates from the Fortinet Support Portal.
3. Test updates in a non-production environment to avoid operational disruption.
4. Deploy patches during maintenance windows, and verify successful installation.
5. Re-enable FortiCloud SSO only after confirming the patch is active and functional.

The Bigger Picture: SSO Security in the Modern Threat Landscape

Single sign-on systems are meant to simplify and secure access, but they also represent a high-value target for attackers. A compromise in an SSO mechanism can expose every application and service tied to it. This incident is a reminder that identity and access management (IAM) solutions must be rigorously tested and continuously monitored.

Over the past two years, SSO-related vulnerabilities have risen by 40%, according to cybersecurity firm CyberRisk Insights. As more organizations adopt cloud-first strategies, the attack surface for identity providers expands—making robust signature validation, encryption, and session management non-negotiable.

In summary, CVE-2025-59718 is a severe and actively exploited vulnerability that demands immediate attention. CISA’s inclusion of the flaw in the KEV catalog should serve as a wake-up call for all organizations using Fortinet products. Patching is the most effective countermeasure, but layered security—including monitoring and segmentation—can reduce risk while updates are rolled out.

Stay vigilant, prioritize your cybersecurity hygiene, and ensure your team is prepared to respond to emerging threats with speed and precision.

Frequently Asked Questions

What is CVE-2025-59718?
CVE-2025-59718 is a signature verification bypass vulnerability in Fortinet’s FortiCloud SSO authentication affecting multiple products. It allows attackers to forge authentication tokens and gain unauthorized access.

How do I know if my organization is affected?
Check your Fortinet product versions against the list provided by Fortinet. If you’re running any of the affected versions, you are vulnerable and should patch immediately.

What should I do if I can’t patch right away?
Consider temporarily disabling FortiCloud SSO, enhancing monitoring for suspicious authentication activity, and isolating affected systems from critical network segments.

Has this vulnerability been widely exploited?
Yes. CISA has confirmed active exploitation in the wild, which is why it was added to the Known Exploited Vulnerabilities catalog.

Are there any indicators of compromise I should look for?
Unusual login attempts, authentication logs showing token validation errors, or access from unexpected IP addresses may indicate exploitation.