CVE-2025-59718 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-12-09

Added to CISA KEV: 2025-12-16 7 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to patched versions: FortiOS 7.6.4+, 7.4.9+, 7.2.12+, or 7.0.18+; FortiProxy 7.6.4+, 7.4.11+, 7.2.15+, or 7.0.22+; FortiSwitchManager 7.2.7+ or 7.0.6+
Review FortiCloud SSO authentication logs for suspicious SAML responses or unauthorized access attempts
Monitor for unexpected administrative access or configuration changes
Consider temporarily disabling FortiCloud SSO if patching cannot be immediately completed
Patch priority: EMERGENCY - patch within 24-48 hours due to active exploitation

Known Exploited Vulnerabilities Catalog
This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially ...Read more
CVE Record: CVE-2025-59718
Description. A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through ...Read more
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more
CISA Adds One Vulnerability to the KEV Catalog | CISA
CVE-2025-0282. Ivanti Connect Secure Vulnerability. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. CISA urges organizations to apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

🔴 CVE-2025-59718