CyberCVE

CVE-2025-22252

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may all

Severity
Critical 9
CVSS 3.1
Exploited
Not listed
EPSS
0.008
53.2th percentile
Discovered by
Not disclosed
Published
May 28, 2025
Assigned by fortinet

Description

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

Weakness: CWE-306

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Fortinet FortiSwitch Routing & Switching cna-assigner
Vendor-reported affected versions (3)
  • Fortinet · FortiProxy
  • Fortinet · FortiSwitchManager
  • Fortinet · FortiOS

Vendor remediation

Please upgrade to FortiProxy version 7.6.2 or above Please upgrade to FortiSwitchManager version 7.2.6 or above Please upgrade to FortiOS version 7.6.1 or above Please upgrade to FortiOS version 7.4.7 or above

References