CVE-2025-47761
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via the fortips driver. A successful attack requires bypassing Windows memory protections such as Heap integrity and HSP, and an active VPN IPSec connection.
Risk Assessment
A local user may execute unauthorized code with higher privileges, potentially leading to privilege escalation on the system.
Recommendation
Update FortiClientWindows to a patched version and restrict local user access on systems with the client installed.
Other vulnerabilities in FortiClientWindows
See all- CVE-2026-84386Medium
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7 and 7.2 all versions may allow attacker to improper access control via an exposed minifilter communication port.
- CVE-2025-46373High
A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections.
Original NVD description (English source)
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS