CVE-2025-22252

critical · 9.8

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

9.8

CVSS

0.9%

EPSS (exploit prob.)

60th

EPSS percentile

2025-05-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
fortinet	fortiproxy	7.6.0
fortinet	fortiswitchmanager	7.2.5
fortinet	fortios	>= 7.4.4, < 7.4.7
fortinet	fortios	7.6.0

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-472

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-22252