# CVE-2025-67862: Fortinet FortiOS and FortiProxy Lua script execution in CLI

Source: https://junglewise.ai/threats/cve-2025-67862-fortinet-fortios-and-fortiproxy-lua-script-execution-in-cli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-67862 · Severity: medium · CVSS 6.7 · Published 2026-06-09

A vulnerability in Fortinet's networking and proxy software could allow an administrator with existing access to bypass security restrictions. By using specific commands, an authorized user could run unauthorized scripts on the system. This could lead to a full compromise of the device, potentially impacting the security of the entire network it manages.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2025-67862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67862 being exploited in the wild.

**How severe is CVE-2025-67862?** Medium severity, with a CVSS score of 6.7, published 9 June 2026.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions; Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, 7.0 all versions.

**Is there a fix for CVE-2025-67862?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-67862 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-67862?** Check whether you run Fortinet FortiOS or Fortinet FortiProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-1244) exists in the Command Line Interface (CLI) of FortiOS and FortiProxy. It stems from an internal asset being exposed to an unsafe debug access level, which allows an authenticated administrator to escape the restricted CLI environment. By providing specially crafted CLI commands, an attacker with high privileges can execute arbitrary Lua scripts on the underlying system. This can lead to a complete loss of confidentiality, integrity, and availability. Patches are available in FortiOS versions 7.6.3, 7.4.8, 7.2.11 and FortiProxy versions 7.6.4, 7.4.11, 7.2.15.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions
- Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, 7.0 all versions

## Timeline

- 2026-06-09: disclosed: Initial publication of the advisory by Fortinet.
- 2026-06-09: advisory: NVD published the CVE record.

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-143](https://fortiguard.fortinet.com/psirt/FG-IR-26-143)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)