6.5
Medium
CVE-2025-22254 An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,…
Description
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiWeb 7.6 | 7.6.0 → 7.6.1 | No fix stated |
| FortiWeb 7.4 | 7.4.0 → 7.4.6 | No fix stated |
| FortiProxy 7.6 | 7.6.0 → 7.6.1 | No fix stated |
| FortiProxy 7.4 | 7.4.0 → 7.4.7 | No fix stated |
| FortiOS 7.6 | 7.6.0 → 7.6.1 | No fix stated |
| FortiOS 7.4 | 7.4.0 → 7.4.6 | No fix stated |
| FortiOS 7.2 | 7.2.0 → 7.2.10 | No fix stated |
| FortiOS 7.0 | 7.0.0 → 7.0.16 | No fix stated |
| FortiOS 6.4 | 6.4.0 → 6.4.15 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiWeb
The 74 CVEs of FortiWeb →
CVE-2026-26035
An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb…
8.8
High
CVE-2026-70466
A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through…
4.8
Medium
CVE-2026-40688
An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0…
6.7
Medium
CVE-2026-39811
A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6,…
4.4
Medium