CVE-2025-47295: Fortinet FortiOS

Low severity, CVSS 3.7. EPSS: 0.8% chance of exploitation in the next 30 days.

A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker's control.

Affected products

• Fortinet FortiOS: from 6.4.0, before 7.0.15 (fixed in 7.0.15); from 7.2.0, before 7.2.8 (fixed in 7.2.8); from 7.4.0, before 7.4.4 (fixed in 7.4.4)

Published 2025-05-28. Last modified 2026-06-17.