CVE-2025-25251
An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker to escalate privileges via crafted XPC m
Severity
High 7.4
CVSS 3.1
Exploited
Not listed
EPSS
0.002
7.8th percentile
Discovered by
Third party
Vendor advisory field
Published
May 28, 2025
Assigned by fortinet
Description
An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker to escalate privileges via crafted XPC messages.
Weakness: CWE-863
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiClientMac
Credit
Fortinet is pleased to thank Yaniv Nizry from Sonar for reporting this vulnerability under responsible disclosure.
Vendor remediation
Please upgrade to FortiClientMac version 7.4.3 or above Please upgrade to FortiClientMac version 7.2.9 or above