Fortinet Security Updates – 13 August 2025

The addressed vulnerabilities could allow the attacker to gain elevated privileges, perform denial of service attacks, conduct cross-site scripting attacks, obtain sensitive information, bypass security restrictions, read arbitrary files via uploading a malicious solution pack, or execute arbitrary code and gain access to the affected product.

Sample of the addressed vulnerabilities:

1. FortiSIEM Remote Command Injection Vulnerability (CVE-2025-25256):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. FortiWeb Improper Handling of Parameters Vulnerability (CVE-2025-52970):

• CVSS: 7.7
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

Sample of the Affected Products:

• FortiManage 7.6.0 through 7.6.1.
• FortiMail 7.6.0 through 7.6.1.
• FortiVoice 6.0 all versions.
• FortiWeb 7.0.0 through 7.0.10.
• FortiOS 7.6.0 through 7.6.2.
• FortiSIEM 6.1 all versions.
• FortiSOAR 7.6.0 through 7.6.1.

It should be highlighted that Fortinet is aware that the vulnerability “CVE-2025- 25256” in FortiSIEM is being exploited in the wild.