Description
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.3 | — |
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.11, 7.2.0 – ≤ 7.2.15, 7.0.1 – ≤ 7.0.22 | — |
Advisories 2
- NCSC-2025-0355 Kwetsbaarheden verholpen in Fortinet FortiOS en FortiProxy NCSC-NL (Netherlands) · Nov 7, 2025
- WID-SEC-2025-2306 Fortinet FortiProxy und FortiOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2025