Vulnerability in Fortinet Fortios
CVE-2025-25253
An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy
EPSS: 0.001 (1.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0
- Fortinet Fortipam — versions 1.4.1
- Fortinet Fortiproxy — versions 7.6.0, 7.4.0, 7.2.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-25253?
- CVE-2025-25253 is a high-severity vulnerability in Fortinet Fortios, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 7.5/10. Published 2025-10-14.
- How severe is CVE-2025-25253?
- High severity. CVSS v3 base score is 7.5 out of 10.