What’s Vulnerable › Vulnerabilities

CVE-2025-25253

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-14 · updated 2026-10-18
• Weakness: CWE-297

Description

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy

Affected products

• Fortinet FortiOS (FortiGate): from 7.0.0 before 7.4.9; from 7.6.0 before 7.6.3 — fixed in 7.4.9, 7.6.3
• Fortinet FortiProxy: from 7.0.0 before 7.4.9; from 7.6.0 before 7.6.2 — fixed in 7.4.9, 7.6.2

How to fix

Upgrade to a fixed version: Fortinet FortiOS (FortiGate) 7.4.9, 7.6.3; Fortinet FortiProxy 7.4.9, 7.6.2. Check the vendor advisory for mitigations.

References

• https://fortiguard.fortinet.com/psirt/FG-IR-24-457
• https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Get alerted when CVE-2025-25253 or the next vulnerability affects your stack