CVE-2025-54973

MEDIUM

FortiAnalyzer 7.0.9-7.0.12, 7.2.0-7.2.10, 7.4.0-7.4.6, 7.6.0-7.6.2 - Race Condition via FortiCloud SSO Requests

Title source: llm
STIX 2.1

Description

A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and before 7.0.13 allows an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.

References (1)

Core 1
Core References

Scores

CVSS v3 5.3
EPSS 0.0005
EPSS Percentile 16.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-362
Status published
Products (1)
fortinet/fortianalyzer 7.0.9 - 7.0.14
Published Oct 14, 2025
Tracked Since Feb 18, 2026