rss-bridge 2025-11-18T23:01:30+00:00

Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Fortinet products, the most severe of which could allow for arbitrary code execution.

FortiClient for Windows is a unified endpoint security solution that provides a range of security features, including a VPN client for secure remote access to corporate networks, antivirus protection, web filtering, and vulnerability assessment.FortiExtender is a device from Fortinet that provides secure 5G/LTE and Ethernet connectivity to extend a network's edge.FortiMail is a secure email gateway from Fortinet that protects against email-borne threats like spam, phishing, and malware, and prevents data loss. FortiPAM provides privileged account management, session monitoring and management, and role-based access control to secure access to sensitive assets and mitigate data breaches.FortiSandbox is an advanced threat detection solution from Fortinet that uses sandboxing to analyze suspicious files and network traffic for advanced threats like zero-day malware and ransomware.FortiADC is an application delivery controller (ADC) that improves the availability, performance, and security of web applications. FortiWeb is a web application firewall (WAF) that protects web applications and APIs from cyberattacks like SQL injection and cross-site scripting, while also helping to meet compliance requirements.FortiVoice is a unified communications solution that combines voice, chat, conferencing, and fax into a single, secure platform for businesses and schools.FortiOS is the Fortinet’s proprietary Operation System which is utilized across multiple product lines.FortiProxy is a secure web gateway product from Fortinet that protects users from internet-borne attacks, enforces compliance, and improves network performance.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected service account. Depending on the privileges associated with the service account an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2025-108

DATE(S) ISSUED:

11/18/2025

OVERVIEW:

Multiple vulnerabilities have been discovered in Fortinet products, the most severe of which could allow for arbitrary code execution.

FortiClient for Windows is a unified endpoint security solution that provides a range of security features, including a VPN client for secure remote access to corporate networks, antivirus protection, web filtering, and vulnerability assessment.
FortiExtender is a device from Fortinet that provides secure 5G/LTE and Ethernet connectivity to extend a network's edge.
FortiMail is a secure email gateway from Fortinet that protects against email-borne threats like spam, phishing, and malware, and prevents data loss.
FortiPAM provides privileged account management, session monitoring and management, and role-based access control to secure access to sensitive assets and mitigate data breaches.
FortiSandbox is an advanced threat detection solution from Fortinet that uses sandboxing to analyze suspicious files and network traffic for advanced threats like zero-day malware and ransomware.
FortiADC is an application delivery controller (ADC) that improves the availability, performance, and security of web applications.
FortiWeb is a web application firewall (WAF) that protects web applications and APIs from cyberattacks like SQL injection and cross-site scripting, while also helping to meet compliance requirements.
FortiVoice is a unified communications solution that combines voice, chat, conferencing, and fax into a single, secure platform for businesses and schools.
FortiOS is the Fortinet’s proprietary Operation System which is utilized across multiple product lines.
FortiProxy is a secure web gateway product from Fortinet that protects users from internet-borne attacks, enforces compliance, and improves network performance.

THREAT INTELLIGENCE:

Fortinet is aware that CVE-2025-58034 has been exploited in the wild.

SYSTEMS AFFECTED:

FortiClientWindows 7.4.0 through 7.4.3
FortiClientWindows 7.2.0 through 7.2.10
FortiClientWindows 7.0 all versions
FortiExtender 7.6.0 through 7.6.1
FortiExtender 7.4.0 through 7.4.6
FortiExtender 7.2 all versions
FortiExtender 7.0 all versions
FortiMail 7.6.0 through 7.6.3
FortiMail 7.4.0 through 7.4.5
FortiMail 7.2 all versions
FortiMail 7.0 all versions
FortiPAM 1.6.0
FortiPAM 1.5 all versions
FortiPAM 1.4 all versions
FortiPAM 1.3 all versions
FortiPAM 1.2 all versions
FortiPAM 1.1 all versions
FortiPAM 1.0 all versions
FortiExtender 7.6.0 through 7.6.1
FortiExtender 7.4.0 through 7.4.6
FortiExtender 7.2 all versions
FortiExtender 7.0 all versions
FortiSandbox 5.0.0 through 5.0.1
FortiSandbox 4.4.0 through 4.4.7
FortiSandbox 4.2 all versions
FortiSandbox 4.0 all versions
FortiADC 8.0 7.6.0 through 7.6.2
FortiADC 7.4.0 through 7.4.7
FortiADC 7.2 all versions
FortiADC 7.1 all versions
FortiADC 7.0 all versions
FortiADC 6.2 all versions
FortiWeb 8.0.0 through 8.0.1
FortiWeb 7.6.0 through 7.6.5
FortiWeb 7.4.0 through 7.4.10
FortiWeb 7.2.0 through 7.2.11
FortiWeb 7.0.0 through 7.0.11
FortiVoice 7.2.0 through 7.2.2
FortiVoice 7.0.0 through 7.0.7
FortiOS 7.6.0 through 7.6.3
FortiOS 7.4.0 through 7.4.8
FortiOS 7.2 all versions
FortiOS 7.0 all versions
FortiOS 6.4 all versions
FortiOS 6.2 all versions
FortiOS 6.0 all versions
FortiPAM 1.6.0
FortiProxy 7.6.0 through 7.6.3
FortiProxy 7.4 all versions
FortiProxy 7.2 all versions
FortiProxy 7.0 all versions

RISK:

Government:

Large and medium government entitiesHIGH

Small governmentMEDIUM

Businesses:

Large and medium business entitiesHIGH

Small business entitiesMEDIUM

Home Users:

LOW

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Fortinet products, the most severe of which could allow for arbitrary code execution. Details of the vulnerabilities are as follows:

Tactic: Initial Access (TA0001)

Technique: Exploitation Public-Facing Application (T1190):

An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiADC virtual server's default error page may allow an unauthenticated attacker to execute malicious code via crafted URL. (CVE-2025-58412)
A stack-based overflow vulnerability [CWE-124] in FortiOS CAPWAP daemon may allow a remote unauthenticated attacker on an adjacent network to achieve arbitrary code execution via sending specially crafted packets. Note that in the default configuration, the attacker must be in control of an authorized FortiAP for the attack to succeed and have access to the same local IP subnet. Additionally, successful exploitation would require defeating stack protection and ASLR. (CVE-2025-58431)
A stack-based overflow vulnerability [CWE-124] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a remote authenticated attacker to execute arbitrary code or command as a low privileged user via specially crafted packets. Successful exploitation would require a large amount of effort in preparation because of stack protection and ASLR. Additionally, attacker must be able to pose as an authorized FortiAP or FortiExtender. (CVE-2025-53843)
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in FortiSandbox may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file. (CVE-2025-46215)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Fortinet has observed this to be exploited in the wild. (CVE-2025-58034)
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests. (CVE-2025-48839)
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiVoice may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests. (CVE-2025-58692)
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in FortiClient Windows may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection. (CVE-2025-47761)
A buffer overflow vulnerability [CWE-120] in FortiExtender json_cli may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands. (CVE-2025-46776)
A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiClient Windows may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys" driver. The attacker would need to bypass the Windows heap integrity protections. (CVE-2025-46373)

Details of lower severity vulnerabilities:

[...]

*Original source*