Platform
fortinet
Fixed in
7.6.2
7.2.6
7.6.1
7.4.7
CVE-2025-22252 describes a critical authentication bypass vulnerability affecting Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and 7.6.0. This flaw allows an attacker possessing knowledge of an existing administrator account to gain unauthorized administrative access to the affected devices. The vulnerability was publicly disclosed on May 28, 2025, and a patch is available from Fortinet.
The impact of CVE-2025-22252 is severe. Successful exploitation allows an attacker to completely compromise the affected Fortinet device, effectively gaining full administrative control. This includes the ability to modify configurations, access sensitive data, install malicious software, and potentially pivot to other systems within the network. The attacker's ability to bypass authentication significantly lowers the barrier to entry, making this vulnerability a high-priority target. A compromised FortiProxy could be used to intercept and modify network traffic, leading to data breaches and further compromise. The potential for lateral movement is significant, as an attacker could leverage the compromised device to gain access to other systems on the network.
CVE-2025-22252 is currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating a higher probability of active exploitation. Public proof-of-concept (PoC) code is likely to emerge, further increasing the risk. The vulnerability's ease of exploitation, coupled with the critical nature of the affected devices, makes it a prime target for attackers. Refer to the Fortinet security advisory for detailed information and mitigation guidance.
Exploit Status
EPSS
0.09% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-22252 is to upgrade to a patched version of Fortinet FortiProxy, FortiSwitchManager, or FortiOS. Fortinet has released updates to address this vulnerability. If immediate patching is not possible due to compatibility concerns or testing requirements, consider implementing temporary workarounds such as restricting access to the FortiProxy management interface to trusted networks and enabling multi-factor authentication where possible. Monitor FortiProxy logs for suspicious activity, particularly failed login attempts or unusual configuration changes. After upgrading, confirm the fix by attempting to access the device with a known admin account and verifying that authentication is enforced as expected.
Update FortiProxy to a version later than 7.6.1, FortiSwitchManager to a version later than 7.2.5, and FortiOS to a version later than 7.4.6 and 7.6.0 to correct the authentication bypass vulnerability. This will prevent an attacker with knowledge of an existing admin account from accessing the device as a valid admin.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-22252 is a critical authentication bypass vulnerability in Fortinet FortiProxy, FortiSwitchManager, and FortiOS, allowing attackers with admin account knowledge to gain unauthorized access.
If you are using FortiProxy versions 7.6.0-7.6.1, FortiSwitchManager 7.2.5, or FortiOS versions 7.4.4-7.4.6 and 7.6.0, you are potentially affected by this vulnerability.
Upgrade to a patched version of FortiProxy, FortiSwitchManager, or FortiOS as recommended by Fortinet. Implement temporary workarounds if patching is delayed.
CVE-2025-22252 is listed on CISA's KEV catalog, suggesting a high probability of active exploitation. Public PoCs are likely to emerge.
Refer to the official Fortinet security advisory for detailed information, mitigation guidance, and patched versions: [https://fortinet.com/security/advisory/fortinet-psirt-25-22](https://fortinet.com/security/advisory/fortinet-psirt-25-22)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.