Two newly cataloged Fortinet vulnerabilities are drawing attention because they sit directly in the authentication path for administrators using SAML-based single sign-on. The issues, tracked as CVE-2025-59718 and CVE-2025-59719, are described in the NIST National Vulnerability Database as authentication bypass conditions tied to processing of SAML data, with at least one entry carrying a CVSS 9.8 score.
Fortinet’s own advisories, as summarized by downstream security bulletins, indicate the exposure pattern is specific but common in enterprise deployments: environments where “Allow administrative login using FortiCloud SSO” is enabled, and SAML is used to gate administrative access. In that configuration, an attacker may be able to craft SAML data in a way that bypasses authentication controls, shifting risk from a single app compromise to privileged access against network security and management infrastructure.
The operational takeaway for defenders is that this is not a “patch one box and move on” event. Affected scope spans FortiOS as well as FortiProxy, FortiSwitchManager, and FortiWeb in specific version ranges, which means remediation typically requires coordinated change management across multiple teams that touch network edge, application delivery, and centralized device administration. Secondary advisories emphasize that patching is the primary fix, but risk can be reduced immediately by tightening exposure of administrative interfaces to trusted networks and, where feasible, temporarily disabling FortiCloud SSO administrative login until updates can be applied.
Post-remediation, incident response teams should treat identity-plane events as potentially high impact: validate administrator account integrity, review authentication logs for anomalous SAML activity around the disclosure window, and confirm that device configurations and policies have not been altered.
Sources: NIST NVD, NIST NVD, CSA Singapore, Secure ISS
—
By Ali Nassar-Smith
