Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 thro

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiProxy

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.2affected
  • 7.4.0 to ≤ 7.4.8affected
  • 7.2.0 to ≤ 7.2.15affected
  • 7.0.5 to ≤ 7.0.22affected

Fortinet FortiOS

Default version status: unaffected

  • 7.4.0 to ≤ 7.4.7affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.0.6 to ≤ 7.0.18affected

References