CVE-2025-59921
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Fortinet FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, 7.0 all versions, and 6.2 all versions have an exposure of sensitive information to an unauthorized actor vulnerability. An authenticated attacker can obtain sensitive data via crafted HTTP or HTTPS requests.
Risk Assessment
An authenticated attacker may gain access to sensitive data, potentially leading to confidentiality breaches.
Recommendation
Apply patches provided by Fortinet for affected versions or restrict access to the device.
Other vulnerabilities in FortiADC
See all- CVE-2025-58412Medium
Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.
- CVE-2025-54971Medium
Fortinet FortiADC (versions 7.4.0, 7.2, 7.1, 7.0, and 6.2) contains an exposure of sensitive information to an unauthorized actor vulnerability. An admin with read-only permission may obtain the external resources password via the product logs.
- CVE-2025-48839Medium
An out-of-bounds write vulnerability (CWE-787) in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, and 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
Original NVD description (English source)
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS