CVE-2025-49201: Fortinet Fortipam

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests

Affected products

• Fortinet Fortipam: from 1.0.0, before 1.4.3 (fixed in 1.4.3); version 1.5.0 only
• Fortinet Fortiswitchmanager: from 7.2.0, before 7.2.5 (fixed in 7.2.5)

Published 2025-10-14. Last modified 2026-06-17.