Fortinet PSIRT Monthly Advisories — August 2025
Tuesday, 12 August 2025
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 1
-
Critical 9.8
CVE-2025-25256 Public exploit Scanner template An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 …EPSS 65%
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
High 7.7
CVE-2025-52970 Public exploit Scanner template A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb…EPSS 10%
All vulnerabilities 14
Critical1 ShowHide
-
Critical 9.8
CVE-2025-25256 Public exploit Scanner template An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 …EPSS 65%
High2 ShowHide
- High 7.9
-
High 7.7
CVE-2025-52970 Public exploit Scanner template A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb…EPSS 10%
Medium11 ShowHide
- Medium 6.8
- Medium 6.7
-
Medium 6.6
CVE-2025-49813 An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and bef…EPSS 1.1%
- Medium 6.5
- Medium 6.4
- Medium 6.3
- Medium 6.3
- Medium 6.2
- Medium 5.2
- Medium 4.8
- Medium 4.2