Fortinet FortiOS bypass (CVE-2025-59718): forged SSO login as super-admin

What happened

On 9 December 2025, Fortinet disclosed CVE-2025-59718 (FG-IR-25-647), an improper-verification-of-cryptographic-signature vulnerability in the FortiCloud SSO login. A remote unauthenticated attacker can forge the SSO response and bypass authentication — no credentials needed.

Fortinet's advisory (FG-IR-25-647) listed wide affected branches — FortiOS 7.0.x through 7.6.x plus FortiProxy and FortiSwitchManager lines — which is most of the installed base. Arctic Wolf reported malicious SSO logins following disclosure, and CISA KEV listing followed.

Impact

Super-admin on the firewall is game over for the perimeter: policy changes, VPN credential dumps, traffic mirroring, and a launchpad into every segment the firewall guards. For retailers processing cards through affected firewalls, this is a PCI-DSS incident the moment exploitability is confirmed.

Root cause in one paragraph

The SSO login handler accepted a response whose signature did not actually cover the asserted identity — verification existed but checked the wrong binding — so a crafted response passed as a legitimate cloud-SSO login for any chosen username, including an administrator.

What to do now

• Upgrade FortiOS to the fixed builds (7.0.18+, 7.2.12+, 7.4.9+, 7.6.4+ or later per the advisory matrix).
• If SSO/SAML admin login is not required, disable it and fall back to local admin accounts with MFA.
• Review admin login logs for SAML logins from unexpected IdPs or source networks.
• Rotate all firewall admin credentials and audit firewall policies for rules you did not create.
• Segment management interfaces off the internet entirely — FortiOS management should never face raw inbound traffic.

What this means for Magento stores

Payment and admin traffic for many Magento deployments flows through FortiGate appliances. A firewall super-admin compromise upstream of the store can redirect or mirror card-data traffic before it ever reaches your hardened PHP. Patch the network tier on the same urgency as the app tier, and alert on any firewall policy change the way you alert on admin-user creation in Magento.

Sources

• NVD: CVE-2025-59718
• Fortinet PSIRT FG-IR-25-647, December 2025
• Arctic Wolf observations of malicious SSO logins post-disclosure

Next in this series: PHP core memory issues (CVE-2026-109618) — /blog/cve-2026-php-core-109618