CVE-2025-54973
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A race condition vulnerability in Fortinet FortiAnalyzer allows an attacker to bypass FortiCloud SSO authorization via crafted requests. Affects versions 7.0.0-7.0.13, 7.2.0-7.2.10, 7.4.0-7.4.6, 7.6.0-7.6.2.
Risk Assessment
An attacker could gain unauthorized access to the system, bypassing authentication mechanisms.
Recommendation
Update to the latest patched version or apply temporary mitigations as recommended by the vendor.
Other vulnerabilities in FortiAnalyzer
See all- CVE-2026-84391Medium
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow an attacker to cause denial of service. The attack vector is not specified.
- CVE-2025-61848High
An SQL injection vulnerability in Fortinet FortiAnalyzer, FortiManager and related products (listed versions) may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API.
Original NVD description (English source)
A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and before 7.0.13 allows an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS