CVE-2025-31514

A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all

Severity

Low 2.6

CVSS 3.1

Exploited

Not listed

EPSS

0.004

30.0th percentile

Discovered by

Third party

Vendor advisory field

Published

Oct 14, 2025

Assigned by fortinet

Description

A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

Weakness: CWE-532

Affected products

Vendor	Product	Category	Matched by
Fortinet	FortiOS	Firewall / NGFW	cna-assigner
Fortinet	FortiProxy	SASE / SSE / Secure Web	cna-assigner

Vendor-reported products (3)

Fortinet · FortiOS
Fortinet · FortiProxy
Siemens · RUGGEDCOM APE1808

Credit

Fortinet is pleased to thank Robert Alexandrino (NetworkRA) from OI S.A. SOC Team for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiProxy version 7.6.4 or above Upgrade to upcoming FortiProxy version 7.4.14 or above Upgrade to FortiOS version 7.6.4 or above

References

Something wrong here?