Fortinet and Ivanti have released security updates to address multiple critical and high-risk vulnerabilities that could enable attackers to bypass authentication mechanisms or execute malicious code on affected systems.
Fortinet’s patches cover serious flaws in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, stemming from improper verification of cryptographic signatures. Tracked as CVE-2025-59718 and CVE-2025-59719, the vulnerabilities could allow an unauthenticated attacker to bypass FortiCloud SSO login protections using a crafted SAML message.
“An Improper Verification of Cryptographic Signature vulnerability in FortiOS, FortiWeb, FortiProxy and FortiSwitchManager may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message, if that feature is enabled on the device,” Fortinet said in its advisory.
The company noted that FortiCloud SSO is disabled by default, but may be activated when administrators register a device with FortiCare. As a precaution, organizations using the feature are urged to disable FortiCloud login temporarily until patches are fully deployed.
Ivanti, meanwhile, has issued fixes for four security issues in its Endpoint Manager (EPM) product, including a high-risk vulnerability (CVE-2025-10573) affecting the EPM core and remote consoles. The flaw, which is a stored cross-site scripting (XSS) issue, allows remote, unauthenticated attackers to run arbitrary JavaScript in an administrator’s browser session.
“Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required,” Ivanti noted.
The vulnerability was reported by Rapid7 researcher Ryan Emmons, who discovered that it could be exploited by adding maliciously crafted fake endpoints to the EPM server. When administrators view compromised dashboard elements, the attacker’s JavaScript executes automatically, effectively taking over the session.