CVE-2025-25250: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions

Status

Published

2025-06-10

Updated

2026-10-15

Assigning organization

fortinet

Description

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS

Default version status: unaffected

7.6.0affected
7.4.0 to ≤ 7.4.7affected
7.2.0 to ≤ 7.2.13affected
7.0.0 to ≤ 7.0.19affected
6.4.0 to ≤ 6.4.16affected

Fortinet FortiSASE