High severity · published Jun 10, 2025
CVE-2025-22256
A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortipam · Fortinet
1.0.0 before 1.0.4; 1.1.0 before 1.1.3; 1.4.0 before 1.4.2; 1.2.0; 1.3.0 · source: NVD
FO
Fortisra · Fortinet
1.4.0 before 1.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22256
Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-25-008
More from Fortipam
9.8
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability
6.5
CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
9.8
CVE-2025-49201
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions,…
9.8
CVE-2024-26011
A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11,…
8.8
CVE-2025-57740
An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions;…