CVE-2025-22862

MEDIUM

FortiOS 7.0.6-7.4.7 and FortiProxy 7.0.5-7.6.2 - Authenticated Privilege Escalation via Automation Stitch Webhook Action

Title source: llm
STIX 2.1

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

References (2)

Core 2

Scores

CVSS v3 6.7
EPSS 0.0024
EPSS Percentile 14.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-288
Status published
Products (9)
Fortinet/FortiOS 7.0.6 - 7.0.18
fortinet/fortios 7.0.6 - 7.2.12
Fortinet/FortiOS 7.2.0 - 7.2.11
Fortinet/FortiOS 7.4.0 - 7.4.7
Fortinet/FortiProxy 7.0.5 - 7.0.22
fortinet/fortiproxy 7.0.5 - 7.4.9
Fortinet/FortiProxy 7.2.0 - 7.2.15
Fortinet/FortiProxy 7.4.0 - 7.4.8
Fortinet/FortiProxy 7.6.0 - 7.6.2
Published Oct 02, 2025
Tracked Since Feb 18, 2026