Is CVE-2025-25253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-25253 being exploited in the wild.

How severe is CVE-2025-25253?

High severity, with a CVSS score of 7.5, published 14 October 2025.

Which products and versions are affected?

Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions; Fortinet FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions.

Is there a fix for CVE-2025-25253?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-25253 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2025-25253?

Check whether you run Fortinet FortiOS or Fortinet FortiProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-25253: Fortinet FortiOS and FortiProxy certificate validation bypass in ZTNA proxy

CVE-2025-25253 · Severity: high · CVSS 7.5 · Published 2025-10-14

A security flaw exists in Fortinet's Zero Trust Network Access (ZTNA) proxy, a component used to securely connect remote users to internal applications. An attacker positioned on the same local network as the device could intercept and modify encrypted traffic between users and the proxy. This could lead to the exposure of sensitive information or unauthorized tampering with corporate data.

Technologies: Fortinet FortiOS, Fortinet FortiProxy. Vendors: Fortinet.

Quick answers

Is CVE-2025-25253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-25253 being exploited in the wild.
How severe is CVE-2025-25253?: High severity, with a CVSS score of 7.5, published 14 October 2025.
Which products and versions are affected?: Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions; Fortinet FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions.
Is there a fix for CVE-2025-25253?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-25253 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2025-25253?: Check whether you run Fortinet FortiOS or Fortinet FortiProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-297) is caused by improper validation of certificates where the host mismatch is not correctly verified within the ZTNA proxy component of FortiOS and FortiProxy. An unauthenticated attacker located in an adjacent network (Man-in-the-Middle position) can exploit this to intercept, decrypt, or modify traffic intended for the ZTNA proxy. The attack requires a high complexity (AC:H) as the attacker must successfully position themselves to intercept the traffic. Fortinet has released patches for FortiOS (7.6.3, 7.4.9) and FortiProxy (7.6.2, 7.4.9) to address this issue.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions
Fortinet FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions

Timeline

2025-10-14: disclosed: Initial publication by Fortinet
2025-10-14: advisory: FortiGuard Labs advisory FG-IR-24-457 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.