What’s Vulnerable › Vulnerabilities
CVE-2025-49201
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-14 · updated 2026-10-18
- Weakness: CWE-1390
Description
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests
Affected products
- Fortinet FortiPAM: from 1.0.0 before 1.4.3; 1.5.0 — fixed in 1.4.3
- Fortinet FortiSwitchManager: from 7.2.0 before 7.2.5 — fixed in 7.2.5
How to fix
Upgrade to a fixed version: Fortinet FortiPAM 1.4.3; Fortinet FortiSwitchManager 7.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-49201 or the next vulnerability affects your stack