CVE-2025-22862: Fortinet FortiOS

Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days.

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

Affected products

• Fortinet FortiOS: from 7.0.6, before 7.2.12 (fixed in 7.2.12); from 7.4.0, before 7.4.8 (fixed in 7.4.8)
• Fortinet FortiProxy: from 7.0.5, before 7.4.9 (fixed in 7.4.9); from 7.6.0, before 7.6.3 (fixed in 7.6.3)

Published 2025-10-02. Last modified 2026-06-17.