What is CVE-2026-25690?

CVE-2026-25690 is a medium-severity vulnerability in Fortinet Fortideceptor, classified under Argument Injection. CVSS score: 4.3/10. Published 2026-05-12.

How severe is CVE-2026-25690?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Fortinet Fortideceptor

CVE-2026-25690

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

EPSS: 0.002 (15.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Fortinet Fortideceptor — versions 5.2.0, 5.2.1, 5.3.0

Weakness classification (CWE)

CWE-88 — Argument Injection

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-138 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-25690?: CVE-2026-25690 is a medium-severity vulnerability in Fortinet Fortideceptor, classified under Argument Injection. CVSS score: 4.3/10. Published 2026-05-12.
How severe is CVE-2026-25690?: Medium severity. CVSS v3 base score is 4.3 out of 10.