Fortinet PSIRT Monthly Advisories — December 2025

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.1
  CVE-2025-59718 Exploited Public exploit A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.…
  EPSS 68%
• Critical 9.1
  CVE-2025-59719 Exploited An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al…
  EPSS 27%

All vulnerabilities 18