CVE-2025-48839
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An out-of-bounds write vulnerability (CWE-787) in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, and 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
Risk Assessment
An authenticated attacker could remotely execute arbitrary code on the FortiADC appliance, potentially leading to full system and network traffic compromise. High impact on confidentiality, integrity, and availability.
Recommendation
Update FortiADC to the latest patched version and restrict administrative access to trusted networks.
Other vulnerabilities in FortiADC
See all- CVE-2025-58412Medium
Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.
- CVE-2025-54971Medium
Fortinet FortiADC (versions 7.4.0, 7.2, 7.1, 7.0, and 6.2) contains an exposure of sensitive information to an unauthorized actor vulnerability. An admin with read-only permission may obtain the external resources password via the product logs.
- CVE-2025-59921Medium
Fortinet FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, 7.0 all versions, and 6.2 all versions have an exposure of sensitive information to an unauthorized actor vulnerability. An authenticated attacker can obtain sensitive data via crafted HTTP or HTTPS requests.
Original NVD description (English source)
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS