Fortinet auth-bypass flaws have public exploit code
Two Fortinet vulnerabilities allow unauthenticated remote attackers to bypass authentication via improper digital signature verification, and exploit code reportedly already exists.
Japan's IPA issued an alert on two Fortinet vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Both stem from improper verification of digital signatures and could allow an unauthenticated remote attacker to bypass authentication. The flaws are specifically tied to environments where FortiCloud SSO login is enabled — a setting that, per Fortinet, can be left active by default when device registration is completed via the GUI without explicitly disabling the 'Allow administrative login using FortiCloud SSO' option.
According to the vendor's own CVSS assessment, exploit code for these vulnerabilities already exists, raising concern about near-term exploitation despite no confirmed in-the-wild attacks being reported at time of publication. IPA is urging organizations to apply the vendor-provided patches and follow the published upgrade procedures, or apply available workarounds where immediate patching is not feasible, given the breadth of deployment of these Fortinet products in enterprise network perimeters.
Mentioned in this report
Detection guidance
Fortinet FortiCloud SSO Authentication Bypass Attempt
Detects HTTP requests to Fortinet appliances with FortiCloud SSO enabled attempting to access authenticated endpoints without valid session credentials, matching the auth-bypass vulnerability pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet FortiCloud SSO Authentication Bypass Attempt
description: Detects attempts to access Fortinet administrative interfaces (FortiOS/FortiWeb/FortiProxy/FortiSwitchManager)
via FortiCloud SSO endpoints without presenting valid authentication tokens or session
cookies. Matches the CVE-2025-59718/CVE-2025-59719 exploitation pattern where digital
signature verification is bypassed.
tags:
- attack.t1190
- attack.initial-access
logsource:
category: proxy
product: fortinet
detection:
selection_fortinet_admin:
DestinationHostname|contains:
- forticloud.com
- sso.fortinet.com
URI|contains:
- /admin/
- /api/v2/
- /login
- /authenticate
selection_no_auth:
http_request_headers|contains:
- 'Authorization:'
- 'Cookie:'
http_request_headers: null
selection_exploit_patterns:
URI|contains:
- access_token=
- assertion=
- saml
http_status_code:
- 200
- 401
condition: selection_fortinet_admin and (selection_no_auth or selection_exploit_patterns)
falsepositives:
- Legitimate SSO configuration and testing by administrators
- Automated health checks from monitoring systems
level: high
id: 72cda65d-322f-541c-86e9-491befee3e69
status: experimental
author: Vorant
Fortinet Device Management Access Without Valid Credentials
Detects direct HTTP/HTTPS connections to Fortinet management interfaces (ports 80, 443, 8080, 10000) with missing or malformed authentication headers, indicating potential exploitation of signature verification bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet Device Management Access Without Valid Credentials
description: Detects unauthenticated or anomalous credential attempts against Fortinet
management interfaces (FortiOS, FortiWeb, FortiProxy, FortiSwitchManager) commonly
exposed on network perimeters. Matches CVE-2025-59718/CVE-2025-59719 where improper
digital signature verification allows bypass of authentication checks.
tags:
- attack.t1190
- attack.initial-access
logsource:
category: network_connection
product: fortinet
detection:
selection_fortinet_mgmt_ports:
DestinationPort:
- 80
- 443
- 8080
- 10000
DestinationHostname|contains:
- fortigate
- fortiswitch
- fortiweb
- fortiproxy
selection_no_auth_header:
http_request_headers|contains:
- 'Authorization:'
- 'Cookie:'
http_request_headers: null
selection_admin_path:
URI|contains:
- /admin
- /api/v2/cmdb
- /system
- /user
filter_health_checks:
User_Agent|contains:
- Zabbix
- Nagios
- Icinga
- Prometheus
condition: (selection_fortinet_mgmt_ports and selection_admin_path and selection_no_auth_header)
and not filter_health_checks
falsepositives:
- Monitoring and health-check services probing management interfaces
- Administrative tools scanning for Fortinet devices
level: high
id: e4259251-028c-5729-9635-ddff40ed005d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251217.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free