Is CVE-2025-31366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-31366 being exploited in the wild.

How severe is CVE-2025-31366?

Medium severity, with a CVSS score of 4.7, published 14 October 2025.

Which products and versions are affected?

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; Fortinet Fortisase 25.2.a; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.4.9.

Is there a fix for CVE-2025-31366?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-31366 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-31366?

Check whether you run Fortinet FortiOS, Fortinet FortiProxy, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-31366: Fortinet FortiOS and FortiProxy XSS and Open Redirect in Web Filter

Q: Is there a fix for CVE-2025-31366?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-31366 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2025-31366?

Check whether you run Fortinet FortiOS, Fortinet FortiProxy, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-31366 · Severity: medium · CVSS 4.7 · Published 2025-10-14

A security vulnerability exists in the web filtering warning pages of Fortinet networking devices, including FortiOS firewalls and FortiProxy gateways. An attacker could use this flaw to redirect users to malicious websites or execute unauthorized scripts in a user's browser by tricking them into clicking a specially crafted link. This could lead to the theft of login credentials or sensitive session information from users managing or accessing the network.

Technologies: Fortinet FortiOS, Fortinet FortiProxy, Fortinet Fortisase, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2025-31366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-31366 being exploited in the wild.
How severe is CVE-2025-31366?: Medium severity, with a CVSS score of 4.7, published 14 October 2025.
Which products and versions are affected?: Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; Fortinet Fortisase 25.2.a; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.4.9.
Is there a fix for CVE-2025-31366?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-31366 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-31366?: Check whether you run Fortinet FortiOS, Fortinet FortiProxy, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability consists of Improper Neutralization of Input During Web Page Generation (CWE-79) and URL Redirection to Untrusted Site (CWE-601) within the Web Filter warning page component. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request that, if processed by a victim's browser (typically via a malicious link), executes arbitrary JavaScript in the context of the victim's session or redirects them to an external malicious domain. The attack requires user interaction (clicking a link). Fortinet has released patches for FortiOS (7.6.4, 7.4.9) and FortiProxy (7.6.4), while FortiSASE was remediated in version 25.3.b.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions
Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions
Fortinet FortiSASE 25.2.a
Siemens RUGGEDCOM APE1808 All versions with Fortinet NGFW < V7.4.9

Timeline

2025-10-14: disclosed: Initial publication by Fortinet
2025-10-14: advisory
2025-05-13: other: Siemens advisory publication (pre-dated Fortinet's specific CVE disclosure)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.