CVE-2025-31365

MediumCVSS 5.8

Published: 14/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

18th percentile - higher than 18% of all known CVEs

Summary

A Code Injection vulnerability (CWE-94) in FortiClientMac 7.4.0 through 7.4.3 and 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host by tricking the user into visiting a malicious website.

Risk Assessment

The risk includes the possibility of full compromise of the victim's system, leading to data theft, malware installation, or use of the system for further attacks. The attack does not require authentication, increasing its accessibility.

Recommendation

Immediately update FortiClientMac to a version that includes a fix. Also inform users about the risk of visiting unknown websites.

Other vulnerabilities in FortiClientMac

CVE-2025-57741High
An Incorrect Permission Assignment for Critical Resource vulnerability in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and 7.0 all versions may allow a local attacker to run arbitrary code or commands via LaunchDaemon hijacking.

Original NVD description (English source)

An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS