CVE-2025-54821

low-risk

Published 2025-11-18

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 1.9/10 Low

LOCAL / HIGH complexity

Affected Products (3)

Fortiproxy

Fortipam

Fortios

Affected Vendors

Fortinet

References (1)

Vendor Advisory https://fortiguard.fortinet.com/psirt/FG-IR-25-545

/ 100

low-risk

Severity 5/34 · Minimal

Exploitability 0/34 · Minimal

Exposure 9/34 · Low