Fortinet PSIRT Monthly Advisories — June 2025

Tuesday, 10 June 2025

Vulnerabilities: 13
Critical: 0
High: 1
Zero-days: 0
Public exploit: 1

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Public exploit code 1

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

Medium 4.4
CVE-2024-50562 Public exploit An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version…
EPSS 1.2%

All vulnerabilities 13

High1 Show

High 7.0
CVE-2025-31104 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7…
EPSS 1.1%

Medium8 Show

Medium 6.5
CVE-2025-22254 An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 thro…
Medium 6.0
CVE-2025-22256 A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3,…
Medium 6.0
CVE-2025-24471 An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to…
Medium 5.6
CVE-2024-50568 A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProx…
Medium 4.6
CVE-2024-32119 An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowle…
Medium 4.4
CVE-2024-50562 Public exploit An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version…
EPSS 1.2%
Medium 4.4
CVE-2024-54019 A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow …
Medium 4.1
CVE-2023-48786 A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attack…

Low4 Show

Low 3.9
CVE-2024-45329 A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may a…
Low 3.9
CVE-2025-25250 An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, For…
Low 3.1
CVE-2023-29184 An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM pr…
Low 3.0
CVE-2025-22251 An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all…