# CVE-2025-57740: Fortinet FortiOS heap overflow in SSL-VPN RDP bookmarks

Source: https://junglewise.ai/threats/cve-2025-57740-fortinet-fortios-heap-overflow-in-ssl-vpn-rdp-bookmarks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-14. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-57740 · Severity: high · CVSS 7.5 · Published 2025-10-14

A security vulnerability exists in the SSL-VPN bookmarking feature of several Fortinet products, including FortiOS firewalls and FortiProxy web gateways. An authenticated user could exploit this flaw to execute unauthorized code on the system. This could lead to a complete compromise of the device, potentially allowing an attacker to intercept network traffic or gain a foothold within the corporate network.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Fortinet Fortipam](https://junglewise.ai/threats/technologies/fortipam), [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2025-57740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57740 being exploited in the wild.

**How severe is CVE-2025-57740?** High severity, with a CVSS score of 7.5, published 14 October 2025.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions; Fortinet Fortipam 1.5.0, 1.4.0 through 1.4.2, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; Fortinet FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.3, 7.2 all versions, 7.0 all versions.

**Is there a fix for CVE-2025-57740?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-57740 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-57740?** Check whether you run Fortinet FortiOS, Fortinet Fortipam or Fortinet FortiProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow vulnerability (CWE-122) exists in the RDP bookmark connection component of Fortinet's SSL-VPN functionality. The flaw is present in FortiOS, FortiPAM, and FortiProxy. An attacker must be authenticated to the SSL-VPN portal to exploit this vulnerability. By sending specially crafted requests through an RDP bookmark connection, the attacker can trigger the overflow to achieve arbitrary code execution. Fortinet has released firmware updates for affected branches (e.g., FortiOS 7.6.3, 7.4.8, 7.2.11) and provided virtual patches (FG-VD-60084.0day) for users with active security subscriptions.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions
- Fortinet FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions
- Fortinet FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.3, 7.2 all versions, 7.0 all versions

## Timeline

- 2025-10-14: disclosed: Initial publication by Fortinet
- 2026-03-04: advisory: Updated with IPS package information

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-25-756](https://fortiguard.fortinet.com/psirt/FG-IR-25-756)
- [https://cert-portal.siemens.com/productcert/html/ssa-864900.html](https://cert-portal.siemens.com/productcert/html/ssa-864900.html)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)