CVE-2025-59718

This bug lets an attacker pretend to be you during SSO login. Instead of properly proving identity, the attacker can send a specially made login message and get in without a password. Think of it like a bouncer that can be tricked with a forged ticket—if you rely on that ticket to enter, your building is at risk.

This matters if your business runs Fortinet FortiOS, FortiProxy, or FortiSwitchManager (including deployments where FortiCloud SSO is used for access) at versions within the affected ranges for CVE-2025-59718. The KEV and reported exploitation mean the risk is real in the wild. It is a risk when the vulnerable product is reachable over the network (remote access) in its default/service exposure and the attacker can reach the component handling the SAML/SSO login flow—no login is required to trigger the bypass.

This is RED because CISA confirmed it as actively important via the KEV listing, and exploitation has been reported. Attackers can bypass SSO without authentication, which is exactly the kind of flaw that leads to rapid, unauthorized access and device takeovers. Treat this as an urgent patching event for all affected devices you operate.