CVE-2025-55717

low-risk

Published 2026-03-10

A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited by conditions out of the control of the attacker: An admin must log in to the targeted device.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.0/10 Medium

LOCAL / HIGH complexity

Affected Products (4)

Fortivoice

Fortirecorder

Fortimail

Affected Vendors

Fortinet

References (1)

Vendor Advisory https://fortiguard.fortinet.com/psirt/FG-IR-26-080

/ 100

low-risk

Severity 10/34 · Low

Exploitability 0/34 · Minimal

Exposure 10/34 · Low