Risk Letters

Exploited vulnerability

CVE-2025-59719

TLP:CLEAR

Fortinet FortiWeb

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Facts

  • Vendor: Fortinet
  • Product: FortiWeb
  • CVSS: 9.1
  • EPSS (probability of exploitation within 30 days): 29.2 %
  • First known exploitation: 27 January 2026
  • First seen by Risk Letters: 27 January 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD