CVE-2025-59719: critical vulnerability in Fortinet FortiWeb
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
55Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has an official Brazilian government alert.
ssvc Actcvss 9.1epss 29%
from disclosure to weapon
Published on NVDDec 9
VulnCheck+6d
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · RECOMENDAÇÃO 12/2026 · 24 Jun 2026Recomendação Técnica: Campanha FortiBleed – Exposição de Credenciais e Comprometimento de Dispositivos Fortinet FortiGateread on gov.br ↗
- CTIR Gov · ALERTA 50/2026 · 15 Jun 2026Vulnerabilidades em dispositivos Fortinet associadas ao FortiBleedread on gov.br ↗
- CISC Gov.br · 23 Jan 2026Exploração Ativa de Bypass de Autenticação em Dispositivos Fortinet (Patch Bypass)read on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Affected products
Fortinet · FortiWebRelated CVEs — Fortinet FortiWeb
In the same product, most dangerous first.