← Back

CVE-2025-68648

nvd nist
Published: Mar 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14 may allow an attacker to escalate its privileges via specially crafted requests.

Affected (8)

Fortinet
4 products
Fortianalyzer
Fortianalyzer Cloud
Fortimanager
Fortimanager Cloud
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortianalyzer
From 7.0.0 to 7.4.8
Fortianalyzer
From 7.6.0 to 7.6.5
Fortinet
Fortianalyzer Cloud
From 7.0.0 to 7.4.8
Fortianalyzer Cloud
From 7.6.0 to 7.6.5
Fortinet
Fortimanager
From 7.0.0 to 7.4.8
Fortimanager
From 7.6.0 to 7.6.5
Fortinet
Fortimanager Cloud
From 7.0.0 to 7.4.8
Fortimanager Cloud
From 7.6.0 to 7.6.5

Related CWEs

CWE-134
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.