What is CVE-2025-54821?

CVE-2025-54821 is a low-severity vulnerability in Fortinet Fortios, classified under Improper Privilege Management. CVSS score: 1.9/10. Published 2025-11-18.

How severe is CVE-2025-54821?

Low severity. CVSS v3 base score is 1.9 out of 10.

Privilege escalation in Fortinet Fortios

CVE-2025-54821

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, For…

Vulnerability class: Privilege Escalation

EPSS: 0.001 (4.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 1.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N.

Affected products

Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0
Fortinet Fortipam — versions 1.6.0, 1.5.0, 1.4.0
Fortinet Fortiproxy — versions 7.6.0, 7.4.0, 7.2.0
Fortinet Fortisase — versions 25.2.91

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-545 (Vendor Advisory)
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Frequently asked questions

What is CVE-2025-54821?: CVE-2025-54821 is a low-severity vulnerability in Fortinet Fortios, classified under Improper Privilege Management. CVSS score: 1.9/10. Published 2025-11-18.
How severe is CVE-2025-54821?: Low severity. CVSS v3 base score is 1.9 out of 10.