Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
The Australian cyber agency says organisations need to check their networks for several vulnerable Fortinet products.
Australian organisations need to be on the lookout for a swathe of Fortinet products that may be vulnerable to a pair of newly disclosed vulnerabilities.
The Australian Signals Directorate’s Australian Cyber Security Agency (ASD’s ACSC) recently released a critical alert regarding the vulnerabilities, CVE-2025-59718 and CVE-2025-59719.
Both involve improper verification of cryptographic signatures, with CVE-2025-59718 impacting Fortinet FortiOS, FortiProxy, and FortiSwitchManager, and CVE-2025-59719 impacting Fortinet FortiWeb.
The two vulnerabilities could lead to an attacker bypassing FortiCloud SSO login authentication using a specially crafted SAML response message.
“Australian organisations should review their networks for use of vulnerable versions of the Fortinet products, and consult the Fortinet Advisory for mitigation advice and patching,” the ASD’s ACSC said in a 10 December advisory.
“Mitigation may include disabling FortiCloud login (if enabled) until the latest patches are applied. Organisations should also investigate for any unauthorised access or compromise of affected products.”
Fortinet had some more details in its own update regarding the vulnerabilities.
“Please note that the FortiCloud SSO login feature is not enabled in default factory settings,” Fortinet said.
“However, when an administrator registers the device to FortiCare from the device’s GUI, unless the administrator disables the toggle switch ‘Allow administrative login using FortiCloud SSO’ in the registration page, FortiCloud SSO login is enabled upon registration.
“To prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled) temporarily until upgrading to a non-affected version.”
The following products and versions are affected:
FortiOS
FortiProxy
FortiSwitchManager
FortiWeb
You can find more information on these vulnerabilities here.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
