CVE-2025-57741

HighCVSS 7.8

Published: 14/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

An Incorrect Permission Assignment for Critical Resource vulnerability in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and 7.0 all versions may allow a local attacker to run arbitrary code or commands via LaunchDaemon hijacking.

Risk Assessment

A local attacker could exploit this vulnerability to gain full control of the system, potentially compromising data confidentiality, integrity, and availability.

Recommendation

Update FortiClientMac to the latest patched version and restrict access to LaunchDaemon to trusted users only.

Other vulnerabilities in FortiClientMac

CVE-2025-31365Medium
A Code Injection vulnerability (CWE-94) in FortiClientMac 7.4.0 through 7.4.3 and 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host by tricking the user into visiting a malicious website.

Original NVD description (English source)

An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local attacker to run arbitrary code or commands via LaunchDaemon hijacking.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS