CVE-2025-67862

This vulnerability is a “backstage door” problem. In some Fortinet firewall/proxy versions, an administrator who can reach the device’s command interface may be able to trick it into running Lua scripts in ways it shouldn’t. If that admin account is misused (or compromised), it could let an attacker change behavior and disrupt service.

This matters if your small business uses Fortinet FortiOS (as your network security gateway) and/or FortiProxy (as your proxy service) on one of the affected versions. The key risk is only when someone already has an authenticated admin account and can send crafted CLI commands to the device. If you don’t have exposed management access and your admin accounts are tightly controlled, the practical risk is lower.

Although this has a medium severity rating, the exposure involves running scripts on the device, which can lead to meaningful disruption if admin access is abused. There is no public exploit code on record and it is not in CISA KEV, but Fortinet has provided fixed versions and press attention is rising—so plan to patch promptly rather than waiting.

1. Confirm exposure (versions)

   • In FortiOS: check System Information/Status to identify your exact FortiOS version.
   • In FortiProxy: check System Information to identify your FortiProxy version.
   • Treat the device as potentially affected if it matches any of these ranges from the advisory:
     • FortiOS: 7.6.0–7.6.2, 7.4.0–7.4.7, 7.2.0–7.2.10, 7.0.0–7.0.16, and FortiOS 6.4 (all versions).
     • FortiProxy: 7.6.0–7.6.3, 7.4.0–7.4.10, 7.2.0–7.2.14, and FortiProxy 7.0 (all versions).

2. Upgrade to the fixed releases

   • Fortinet PSIRT guidance (FG-IR-26-143) states upgrades to:
     • FortiOS 7.6.3 or above
     • FortiOS 7.4.8 or above
     • FortiOS 7.2.11 or above
     • FortiOS 7.0.17 or above
     • FortiProxy 7.6.4 or above
   • Apply the upgrade for the specific product/branch you run.
   • Plan for a maintenance window appropriate to your deployment model (HA/cluster changes may require additional coordination).

3. Temporary containment if you can’t patch immediately

   • Restrict access to administrative interfaces so that only trusted administrators from trusted networks can reach the management/CLI.
   • Remove/disable unused admin accounts and review who has admin privileges.
   • Strengthen admin authentication (strong unique passwords; consider additional access controls available in your environment).

4. What to monitor after upgrade

   • Confirm the device reports the expected fixed version.
   • Review admin activity logs for unexpected CLI usage (especially unusual command patterns) leading up to and around the change window.

5. Timing

   • There is no KEV listing and no public exploit code on record in the findings, so you’re not reacting to an active public worm—but given the risk is tied to admin command execution, patching should still be prioritized.

CVE-2025-67862 is a CWE-1244 issue described as “Internal Asset Exposed to Unsafe Debug Access Level or State.” The findings indicate that on affected Fortinet FortiOS/FortiProxy versions, an authenticated admin can execute Lua scripts via crafted CLI commands, implying unsafe debug/state exposure that allows unintended scripting execution.

The findings show no KEV entry and no public exploit code on record, and EPSS is only predicted (no public numbers should be relied on as confirmation). Patch availability is confirmed via Fortinet PSIRT advisory FG-IR-26-143, with fixed versions across multiple maintenance branches. KEV is not listed in CISA KEV, and exploitation maturity is not confirmed by the provided findings.