This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 18 vulnerabilities

Fortinet fixes 18 vulnerabilities in its products. The most serious of them are described below; the remaining ones can be found in the individual links. Products and their fixed versions: FortiADC - 8.0.1, 7.6.4 [1][2][3] FortiClientWindows - 7.4.4, 7.2.11 [4][5][6] FortiExtender - 7.6.3, 7.4.8 [7][8] FortiOS - 7.6.4, 7.4.9 [9][10][11] FortiPAM - 1.6.1 [9][12] FortiProxy - 7.6.4 [9] FortiSASE - 25.3.c (no user action required) [10] FortiSandbox - 5.0.2, 4.4.8 [13] FortiVoice - 7.2.3, 7.0.8 [14] FortiWeb - 8.0.2, 7.6.6 [15][16][17] FortiMail - 7.6.4, 7.4.6 (to be released) [18]

FortiWeb - administrative command execution (CVE-2025-64446)
CVSS 9.8 (Critical)

Due to a relative path traversal vulnerability in FortiWeb, an unauthenticated remote attacker can execute administrative commands on the system by sending HTTP/HTTPS requests. After updating, it is recommended to review the configuration and logs for suspicious modifications or unauthorized admin accounts. If an immediate update is not possible, Fortinet recommends temporarily disabling HTTP/HTTPS on interfaces exposed to the Internet [17]. The vulnerability has been added to the CISA list of actively exploited vulnerabilities [19].

The vulnerability is present in product:

  • FortiWeb; >=7.0.0, <=7.0.11; >=7.2.0, <=7.2.11; >=7.4.0, <=7.4.9; >=7.6.0, <=7.6.4; >=8.0.0, <=8.0.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 11. 2025.

FortiVoice - RCE, command execution (CVE-2025-58692)
CVSS 8.8 (High)

Due to an SQL injection vulnerability in FortiVoice, an authenticated remote attacker can execute code or commands without authorization by means of HTTP/HTTPS requests [20].

The vulnerability is present in product:

  • FortiVoice; >=7.0.0, <=7.0.7; >=7.2.0, <=7.2.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-58692 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 18. 11. 2025.

FortiOS, FortiSASE - RCE, command execution (CVE-2025-58413)
CVSS 7.5 (High)

Due to a memory management error in the CAPWAP process in FortiOS and FortiSASE, an unauthenticated attacker in an adjacent network can execute code or commands without authorization by means of specially crafted packets. With the default configuration, the attack can only be carried out from a compromised, already authorized FortiAP in the same IP subnet and requires bypassing ASLR [21][22]. If the device cannot be updated immediately, recommended temporary mitigations and further configuration information are provided at [21].

The vulnerability is present in products:

  • FortiOS; >=6.0.0, <=6.0.18; >=6.2.0, <=6.2.17; >=6.4.0, <=6.4.16; >=7.0.0, <=7.0.18; >=7.2.0, <=7.2.12; >=7.4.0, <=7.4.8; >=7.6.0, <=7.6.3;
  • FortiSASE; ==25.3.b;

CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 11. 2025.

FortiWeb - RCE, command execution (CVE-2025-58034)
CVSS 7.2 (High)

An authenticated remote attacker can execute code without authorization on the device's operating system in FortiWeb by means of specially crafted HTTP requests or CLI commands [15]. The vulnerability has been added to the CISA list of actively exploited vulnerabilities [23].

The vulnerability is present in product:

  • FortiWeb; >=7.0.0, <=7.0.11; >=7.2.0, <=7.2.11; >=7.4.0, <=7.4.10; >=7.6.0, <=7.6.5; >=8.0.0, <=8.0.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-58034 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 18. 11. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 24. 11. 2025.

CESNET, z.s.p.o. Logo