This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 16 vulnerabilities in various products

Fortinet fixes 16 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiOS - 7.4.9, 7.6.4 [1] [8] FortiPortal - 7.4.6 [7] FortiProxy - 7.0.22, 7.2.15, 7.4.11, 7.6.4 [1] FortiSwitchManager - 7.0.6, 7.2.7 [1] FortiWeb - 7.0.12, 7.2.12, 7.4.11, 7.6.6, 8.0.2 [1] [13] [15] FortiSandbox - 4.0.7, 4.2.9, 4.4.8, 5.0.3 [2] [3] [4] FortiSandbox PaaS - 24.2 [2] FortiSOAR - 7.5.2, 7.6.4 [5] [6] FortiAuthenticator - 6.6.7 [9] [12] FortiVoice - 6.0.13, 6.4.12, 7.0.8, 7.2.3 [10] [14] FortiExtender - 7.0.5, 7.2.6, 7.4.8, 7.6.4 [11]

FortiOS, FortiProxy, FortiSwitchManager, FortiWeb - authentication bypass (CVE-2025-59718, CVE-2025-59719)
CVSS 9.8 (Critical)

Due to insufficient verification of the cryptographic signature in FortiOS, FortiProxy, FortiSwitchManager and FortiWeb , an unauthenticated remote attacker can bypass FortiCloud SSO authentication and log in to the system without authorization. However, this functionality is not enabled by default, so the vulnerability does not manifest in a standard configuration. More information about the vulnerable configuration and temporary mitigation options can be found at [1].

The vulnerability is present in products:

  • FortiOS; >=7.0.0, <=7.0.17; >=7.2.0, <=7.2.11; >=7.4.0, <=7.4.8; >=7.6.0, <=7.6.3;
  • FortiProxy; >=7.0.0, <=7.0.21; >=7.2.0, <=7.2.14; >=7.4.0, <=7.4.10; >=7.6.0, <=7.6.3;
  • FortiSwitchManager; >=7.0.0, <=7.0.5; >=7.2.0, <=7.2.6;
  • FortiWeb; >=7.4.0, <=7.4.9; >=7.6.0, <=7.6.4; >=8.0.0, <=8.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 9. 12. 2025.

FortiSandbox - command injection (CVE-2025-53949)
CVSS 7.2 (High)

Due to insufficient input sanitization in FortiSandbox, an authenticated remote attacker can execute unauthorized operating system commands via HTTP requests [4].

The vulnerability is present in product:

  • FortiSandbox; >=4.0.0, <=4.0.6; >=4.2.0, <=4.2.8; >=4.4.0, <=4.4.7; >=5.0.0, <=5.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-53949 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 12. 2025.

FortiVoice - arbitrary file write (CVE-2025-60024)
CVSS 8.8 (High)

Due to insufficient restriction of access to file paths in FortiVoice, an authenticated remote attacker can write arbitrary files to the system using HTTP/HTTPS requests [14].

The vulnerability is present in product:

  • FortiVoice; >=7.0.0, <7.0.8; >=7.2.0, <7.2.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-60024 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 12. 2025.

FortiWeb - arbitrary operation execution (CVE-2025-64447)
CVSS 8.1 (High)

Due to insufficient integrity checking of cookies in FortiWeb, an unauthenticated remote attacker can perform arbitrary operations in the system via HTTP/HTTPS requests; exploitation requires knowledge of the device serial number [15].

The vulnerability is present in product:

  • FortiWeb; >=7.0.0, <7.0.12; >=7.2.0, <7.2.12; >=7.4.0, <7.4.11; >=7.6.0, <7.6.6; >=8.0.0, <8.0.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 9. 12. 2025.

By CESNET, z.s.p.o. Henrieta Paločková on 15. 12. 2025.

CESNET, z.s.p.o. Logo