CVE-2025-55018: Fortinet FortiOS

Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header

Affected products

• Fortinet FortiOS: from 6.4.3, up to and including 6.4.16; from 7.0.0, before 7.4.10 (fixed in 7.4.10); version 7.6.0 only

Published 2026-02-10. Last modified 2026-06-17.