What is CVE-2025-22862?

CVE-2025-22862 is a medium-severity vulnerability in Fortinet Fortios, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.7/10. Published 2025-10-02.

How severe is CVE-2025-22862?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Is CVE-2025-22862 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Fortinet Fortios

CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

EPSS: 0.002 (14.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortios — versions 7.4.0, 7.2.0, 7.0.6
Fortinet Fortiproxy — versions 7.6.0, 7.4.0, 7.2.0

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

Public proof-of-concept exploits

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-385 (Vendor Advisory)
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Frequently asked questions

What is CVE-2025-22862?: CVE-2025-22862 is a medium-severity vulnerability in Fortinet Fortios, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.7/10. Published 2025-10-02.
How severe is CVE-2025-22862?: Medium severity. CVSS v3 base score is 6.7 out of 10.
Is CVE-2025-22862 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.