This vulnerability involves improper verification of cryptographic signatures in Fortinet FortiSwitchManager versions 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6, as well as certain FortiOS and FortiProxy versions. An attacker can craft a malicious SAML response message to bypass FortiCloud SSO authentication without any privileges or user interaction. This flaw allows unauthorized access to the affected systems, potentially leading to full compromise. The CVSS 3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass FortiCloud SSO login authentication, granting unauthorized access to FortiSwitchManager and related Fortinet products. This can lead to full compromise of the affected system, including exposure and manipulation of sensitive data and disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Fortinet advisories closely for updates. Until a fix is available, consider restricting access to FortiSwitchManager interfaces and FortiCloud SSO where possible to trusted networks and users only.