CVE-2025-22862

MEDIUM

Fortinet Fortios < 7.2.12 - Authentication Bypass

Title source: rule

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

References (1)

[Vendor Advisory] https://fortiguard.fortinet.com/psirt/FG-IR-24-385

Scores

CVSS v3 6.7

EPSS 0.0002

EPSS Percentile 6.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-288

Status published

Products (2)

fortinet/fortios 7.0.6 - 7.2.12

fortinet/fortiproxy 7.0.5 - 7.4.9

Published Oct 02, 2025

Tracked Since Feb 18, 2026