Fortinet Security Updates – 19 November 2025

The addressed vulnerabilities could allow the attacker to gain elevated privileges, obtain sensitive information, bypass security restrictions, or execute arbitrary code or commands, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. FortiVoice SQL Injections in Voice and Administrative Interface Vulnerability (CVE-2025-58692):

• CVSS: 7.7
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. FortiExtender Authenticated CLI Commands Buffer Overflow Vulnerability (CVE-2025-46776):

• CVSS: 6.3
• Attack Vector: Local
• Attack Complexity: High
• Privileges Required: High
• User Interaction: None
• Consequences: Gain Privilege

Sample of the affected products:

• FortiExtender.
• FortiClientWindows.
• FortiMail.
• FortiWeb.
• FortiSandbox.

It should be highlighted that Fortinet is aware that the zero-day vulnerability “CVE- 2025-58034” in FortiWeb software is being exploited in the wild.