CVE-2025-22254

score

<0.1

cvss

6.6

epss

0.8%

published

2025-06-10

kev added

—

first seen

2026-10-21

Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16 and before 6.4.15, FortiProxy 7.6.0 through 7.6.1 and before 7.4.7, and FortiWeb 7.6.0 through 7.6.1 and before 7.4.6 contain an improper privilege management vulnerability caused by crafted requests to the Node.js websocket module, letting authenticated attackers with read-only admin permissions escalate to super-admin privileges, exploit requires authenticated read-only admin access.