CVE-2025-47761
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via the fortips driver. A successful attack requires bypassing Windows memory protections such as Heap integrity and HSP, and an active VPN IPSec connection.
Risk Assessment
A local user may execute unauthorized code with higher privileges, potentially leading to privilege escalation on the system.
Recommendation
Update FortiClientWindows to a patched version and restrict local user access on systems with the client installed.
Other vulnerabilities in FortiClientWindows
See all- CVE-2026-84386Medium
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7 and 7.2 all versions may allow attacker to improper access control via an exposed minifilter communication port.
- CVE-2026-44278Low
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2 and FortiClientWindows 7.2 all versions may allow an attacker to disclose information.
- CVE-2025-54660Medium
FortiClientWindows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.10, and all versions of 7.0 contain active debug code that may allow a local attacker to run the application step by step and retrieve the saved VPN user password.
- CVE-2025-46373High
A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections.
Original NVD description (English source)
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS