CVE-2025-61713

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-18 · updated 2026-10-18
Weakness: CWE-316

Description

A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated attacker with read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands.

Affected products

Fortinet FortiPAM: from 1.0.0 before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Fortinet FortiPAM 1.6.1. Check the vendor advisory for mitigations.

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-789

Get alerted when CVE-2025-61713 or the next vulnerability affects your stack