An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortiproxy | — | Upgrade FortiProxy to 7.4.8Upgrade to the latest version of FortiProxyUpgrade FortiProxy to 7.6.2 | Sep 30, 2026 | Jun 10, 2025 |
| Fortinet Fortiweb | — | Upgrade FortiWeb to 7.4.7Upgrade FortiWeb to 7.6.2 | Jun 30, 2026 | Jun 10, 2025 |
| Fortios | — | Upgrade FortiOS to 6.4.16Upgrade FortiOS to 7.2.11Upgrade FortiOS to 7.4.7Upgrade FortiOS to 7.6.2Upgrade FortiOS to 7.0.17 | Jul 24, 2025 | Jun 10, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub