CVE-2025-62439

Published: Feb 10, 2026Modified: Jun 17, 2026Deferred

4.2

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability: 1.1 / Impact: 2.7

Source: psirt@fortinet.com (Secondary)

Description

An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.

Related CWEs

CWE-940

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (2)

https://fortiguard.fortinet.com/psirt/FG-IR-25-384

Source: psirt@fortinet.com

https://cert-portal.siemens.com/productcert/html/ssa-975644.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.