Fortinet disclosed a serious vulnerability in FortiOS yesterday that could allow local, privileged users with elevated privileges to execute arbitrary system commands via crafted CLI commands. The bug is tracked as CVE-2025-58325 and is classified as “Incorrect Provision of Specified Functionality” (CWE-684), with a CVSS v3.1 score of 7.8.
FortiOS: What makes the vulnerability dangerous?
The issue is triggered when a user, who already has access rights, executes specially crafted commands in the CLI of the device. While it does not allow remote execution by unauthorized users, the low complexity of exploitation combined with the ability to scale makes the vulnerability particularly dangerous for environments with multiple administrators or where compromised accounts exist. Successful exploitation could lead to complete control of the device, the extraction of sensitive settings, or the ability to move laterally within a corporate network.
See also: Vulnerability in FortiPAM and FortiSwitch Manager bypasses verification process
Which platforms are affected?
Fortinet's research report shows that a number of FortiOS versions — including versions 6.4, 7.0.x, 7.2.x, 7.4.x, and 7.6.0 — may be affected in specific builds. Francois Ropert from Fortinet's PSIRT team is cited as the researcher who discovered the issue. The list of devices includes models from the 100E series to the 7000F.
See also: Zero-day exploit in Windows Remote Access Connection Manager
Fortinet recommends upgrades to versions with patches. The table below lists the affected versions and fixes:
| FortiOS Version | Affected Builds | Recommended Solution |
|---|---|---|
| 7.6 | 7.6.0 | Upgrade to 7.6.1 or later |
| 7.4 | 7.4.0 to 7.4.5 | Upgrade to 7.4.6 or later |
| 7.2 | 7.2.0 to 7.2.10 | Upgrade to 7.2.11 or later |
| 7.0 | 7.0.0 to 7.0.15 | Upgrade to 7.0.16 or later |
| 6.4 | All versions | Upgrade to a fixed version |
Defense Strategy — Immediate Steps
Fortinet urges customers to apply available updates immediately and use the upgrade tool for a smooth transition. Security teams should revoke suspicious tokens, review CLI logs for unusual commands, and restrict access to CLI management with the principle of least privilege. In addition, regular system audits, enabling MFA for management accounts, and monitoring for anomalies in session behavior are recommended.
Special concerns for SSO and federated environments
Although the issue requires local access, organizations with SSO, federated authentication, or multiple third-party management tools need to control interfaces and privilege transfer. A compromised administrative account or a misconfigured token can become a vehicle for the vulnerability to be triggered. Therefore, working with identity providers and strict token management are critical.
See also: Microsoft Patch Tuesday October 2025: 172 vulnerabilities fixed
Why inaction is not allowed
Despite the absence of public indicators of breach or exploits (for now), exploit automation is a matter of time. Prompt patching, vendor communication, and internal notification of management teams are essential actions to reduce operational risk.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
