GCVE-110-NCSC-2025-386

Advisory PublishedCVSS 9.8/10

Vulnetix · Advisory published December 10, 2025

Fortinet products, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, have vulnerabilities allowing unauthenticated attackers to bypass FortiCloud SSO login authentication via crafted SAML messages, necessitating immediate action.

Download JSON Open in Console

Weaknesses (CWE)

CWE-347Improper Verification of Cryptographic SignatureCWE-613Insufficient Session ExpirationCWE-532Insertion of Sensitive Information into Log FileCWE-836Use of Password Hash Instead of Password for AuthenticationCWE-565Reliance on Cookies without Validation and Integrity Checking

Risk Scores

CVSS 3.1

9.8/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Affected Products

Vendor	Product	Versions	Platforms
Fortinet	vers:unknown/*	—	—

Aliases

CVE-2024-47570 CVE-2025-59718 CVE-2025-59719 CVE-2025-62631 CVE-2025-64447 CVE-2025-64471

References

advisory

exploit

advisory

Browse GCVE Records

74,366 records in the GCVE database · Updated July 23, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON