Vulnerability · Published Mar 10, 2026 · Assigned by fortinet
CVE-2025-68648
Medium 6.5
In plain English
A medium-severity security flaw in FortiAnalyzer from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14 may allow an attacker to escalate its privileges via specially crafted requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiManager Cloud | 7.6.2 – through 7.6.37.4.1 – through 7.4.77.2.1 – through 7.2.107.0.1 – through 7.0.14 |
| Fortinet | FortiAnalyzer Cloud | 7.6.27.4.1 – through 7.4.77.2.1 – through 7.2.127.0.1 – through 7.0.16 |
| Fortinet | FortiAnalyzer | 7.6.0 – through 7.6.47.4.0 – through 7.4.77.2.0 – through 7.2.127.0.0 – through 7.0.16 |
| Fortinet | FortiManager | 7.6.0 – through 7.6.47.4.0 – through 7.4.77.2.0 – through 7.2.127.0.0 – through 7.0.16 |
Weakness: CWE-134 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C