{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D032DF6-3C57-4EB8-8B65-CB3330FB2440",
              "versionEndExcluding": "7.2.11",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4490512-36ED-4212-9D34-D74739A56E84",
              "versionEndExcluding": "7.4.3",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.10, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. The success of the attack depends on the ability to bypass the stack protection mechanisms."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basado en pila [CWE-121] vulnerabilidad en Fortinet FortiManager 7.4.0 hasta 7.4.2, FortiManager 7.2.0 hasta 7.2.10, FortiManager 6.4 todas las versiones puede permitir a un atacante remoto no autenticado ejecutar comandos no autorizados a trav\u00e9s de solicitudes manipuladas, si el servicio est\u00e1 habilitado. El \u00e9xito del ataque depende de la capacidad para eludir los mecanismos de protecci\u00f3n de pila."
    }
  ],
  "id": "CVE-2025-54820",
  "lastModified": "2026-03-12T21:17:31.313",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-10T18:17:58.363",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-098"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Fortinet heeft kwetsbaarheden verholpen in FortiAnalyzer en FortiManager (inclusief cloudvarianten).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met kenmerk CVE-2025-54820  zit in FortiManager. Deze kwetsbaarheid stelt een remote ongeauthenticeerde kwaadwillende in staat om via een stack-gebaseerde buffer overflow in de fgtupdates-service ongeautoriseerde commando\u0027s uit te voeren. Verder is er onder andere ook een kwetsbaarheid door onjuiste certificaatvalidatie die man-in-the-middle aanvallen mogelijk maakt, en een format string kwetsbaarheid die remote aanvallers met administratieve privileges in staat stelt om willekeurige code uit te voeren. Bovendien zijn er kwetsbaarheden in de multifactor authenticatie implementatie en in de beperking van overmatige authenticatiepogingen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Fortinet heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
        "title": "CWE-89"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Use of Externally-Controlled Format String",
        "title": "CWE-134"
      },
      {
        "category": "general",
        "text": "Authentication Bypass Using an Alternate Path or Channel",
        "title": "CWE-288"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Excessive Authentication Attempts",
        "title": "CWE-307"
      },
      {
        "category": "general",
        "text": "Hidden Functionality",
        "title": "CWE-912"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-078"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-079"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-081"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-090"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-092"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-095"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-098"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Fortinet FortiManager en FortiAnalyzer",
    "tracking": {
      "current_release_date": "2026-03-11T09:19:38.777277Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0086",
      "initial_release_date": "2026-03-11T09:19:38.777277Z",
      "revision_history": [
        {
          "date": "2026-03-11T09:19:38.777277Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiAnalyzer"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiAnalyzer Cloud"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiManager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiManager Cloud"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48418",
      "cwe": {
        "id": "CWE-912",
        "name": "Hidden Functionality"
      },
      "notes": [
        {
          "category": "other",
          "text": "Hidden Functionality",
          "title": "CWE-912"
        },
        {
          "category": "description",
          "text": "A vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote authenticated read-only admin with CLI access to escalate privileges using an undocumented hidden command.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48418 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48418.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2025-48418"
    },
    {
      "cve": "CVE-2025-54820",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "A stack-based buffer overflow vulnerability in Fortinet FortiManager versions 6.4 through 7.4.2, specifically in the fgtupdates service, may allow remote unauthenticated attackers to execute unauthorized commands by bypassing stack protection via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-54820 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-54820.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2025-54820"
    },
    {
      "cve": "CVE-2025-68482",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "A vulnerability in multiple versions of Fortinet FortiAnalyzer and FortiManager enables remote unauthenticated attackers to conduct man-in-the-middle attacks and access confidential data due to improper certificate validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-68482 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-68482.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2025-68482"
    },
    {
      "cve": "CVE-2025-68648",
      "cwe": {
        "id": "CWE-134",
        "name": "Use of Externally-Controlled Format String"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Externally-Controlled Format String",
          "title": "CWE-134"
        },
        {
          "category": "description",
          "text": "Multiple versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud contain an externally-controlled format string vulnerability (CWE-134) in the fazsvcd daemon that may allow remote attackers with admin privileges to execute arbitrary code or escalate privileges via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-68648 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-68648.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2025-68648"
    },
    {
      "cve": "CVE-2026-22572",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authentication Bypass Using an Alternate Path or Channel",
          "title": "CWE-288"
        },
        {
          "category": "description",
          "text": "A vulnerability in Fortinet FortiAnalyzer and FortiManager allows attackers with the admin password to bypass multifactor authentication by submitting multiple crafted requests, enabling MFA circumvention.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22572 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22572.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-22572"
    },
    {
      "cve": "CVE-2026-22629",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Excessive Authentication Attempts",
          "title": "CWE-307"
        },
        {
          "category": "description",
          "text": "Multiple versions of Fortinet FortiAnalyzer and FortiManager, including cloud variants, contain a CWE-307 vulnerability that allows attackers to bypass brute force protections by exploiting race conditions in authentication attempts.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22629 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22629.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-22629"
    },
    {
      "cve": "CVE-2025-49784",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "title": "CWE-89"
        },
        {
          "category": "description",
          "text": "Fortinet FortiAnalyzer and FortiAnalyzer-BigData versions 6.2 through 7.6.4 contain an SQL injection vulnerability that allows authenticated attackers to execute unauthorized code or commands via specially crafted API requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-49784 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49784.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:T/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2025-49784"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiClientLinux versions 7.4.x ant\u00e9rieures \u00e0 7.4.5",
      "product": {
        "name": "FortiClient",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer-BigData versions 7.6.x ant\u00e9rieures \u00e0 7.6.1",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.4.x ant\u00e9rieures \u00e0 7.4.5",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientLinux versions ant\u00e9rieures \u00e0 7.2.13",
      "product": {
        "name": "FortiClient",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox versions ant\u00e9rieures \u00e0 4.4.8",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager Cloud versions ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.6.x ant\u00e9rieures \u00e0 7.6.3",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDeceptor toutes versions ant\u00e9rieures \u00e0 6.2.1",
      "product": {
        "name": "FortiDeceptor",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiVoice versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiVoice",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer Cloud versions ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSOAR Agent Communication Bridge versions ant\u00e9rieures \u00e0 1.1.1",
      "product": {
        "name": "FortiSOAR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions ant\u00e9rieures \u00e0 7.6.7",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiVoice versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiVoice",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSIEM versions 7.4.x ant\u00e9rieures \u00e0 7.4.1",
      "product": {
        "name": "FortiSIEM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSIEM versions 7.3.x ant\u00e9rieures \u00e0 7.3.5",
      "product": {
        "name": "FortiSIEM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 8.0.x ant\u00e9rieures \u00e0 8.0.4",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder toutes versions ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer-BigData versions ant\u00e9rieures \u00e0 7.4.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.2.x ant\u00e9rieures \u00e0 7.2.8",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitchAXFixed versions 1.0.x ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "FortiSwitch",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.0.x ant\u00e9rieures \u00e0 7.0.9",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-30897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-30897"
    },
    {
      "name": "CVE-2025-53608",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53608"
    },
    {
      "name": "CVE-2026-24017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24017"
    },
    {
      "name": "CVE-2025-68648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68648"
    },
    {
      "name": "CVE-2026-24640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24640"
    },
    {
      "name": "CVE-2026-22572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22572"
    },
    {
      "name": "CVE-2025-48418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48418"
    },
    {
      "name": "CVE-2025-48840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48840"
    },
    {
      "name": "CVE-2026-24641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24641"
    },
    {
      "name": "CVE-2026-22627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22627"
    },
    {
      "name": "CVE-2025-55717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55717"
    },
    {
      "name": "CVE-2026-24018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24018"
    },
    {
      "name": "CVE-2025-54820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54820"
    },
    {
      "name": "CVE-2025-49784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49784"
    },
    {
      "name": "CVE-2026-22629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22629"
    },
    {
      "name": "CVE-2025-66178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66178"
    },
    {
      "name": "CVE-2026-25689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25689"
    },
    {
      "name": "CVE-2026-25972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25972"
    },
    {
      "name": "CVE-2025-54659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54659"
    },
    {
      "name": "CVE-2025-68482",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68482"
    },
    {
      "name": "CVE-2026-22628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22628"
    },
    {
      "name": "CVE-2026-25836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25836"
    }
  ],
  "initial_release_date": "2026-03-11T00:00:00",
  "last_revision_date": "2026-03-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0265",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Fortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nConcernant la vuln\u00e9rabilit\u00e9 CVE-2025-66178, l\u0027\u00e9diteur fournit certaines recommandations dans l\u0027attente de la version correctrice.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-078",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-078"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-096",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-096"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-098",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-098"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-080",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-080"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-088",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-088"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-094",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-094"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-092",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-092"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-090",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-090"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-081",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-081"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-095",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-095"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-093",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-093"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-083",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-083"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-087",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-087"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-079",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-079"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-086",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-086"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-077",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-077"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-082",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-082"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-097",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-097"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-085",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-085"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-091",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-091"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-089",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-089"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-084",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-084"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-54820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-10T18:17:58Z",
    "severity": "HIGH"
  },
  "details": "A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.10, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. The success of the attack depends on the ability to bypass the stack protection mechanisms.",
  "id": "GHSA-qq5m-xh4x-hv7f",
  "modified": "2026-03-10T18:31:18Z",
  "published": "2026-03-10T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54820"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-098"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}