CVE-2025-46774
An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.001
0.3th percentile
Discovered by
Third party
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet
Description
An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.
Weakness: CWE-347
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiClientMac
Credit
Fortinet is pleased to thank Mykola Grymalyuk from RIPEDA Consulting for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiClientMac version 7.4.4 or above Upgrade to FortiClientMac version 7.2.10 or above