Vulnerability · Published Jun 9, 2026 · Assigned by fortinet
CVE-2025-67862
Medium 6.0
In plain English
A medium-severity security flaw in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.6.0 – through 7.6.17.4.0 – through 7.4.67.2.0 – through 7.2.107.0.0 – through 7.0.166.4.0 – through 6.4.16 |
| Fortinet | FortiProxy | 7.6.0 – through 7.6.37.4.0 – through 7.4.107.2.0 – through 7.2.147.0.0 – through 7.0.23 |
Weakness: CWE-1244 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C