PT-2025-41946 · Fortinet · Fortiswitchmanager+4

Published 2025-10-14 · Updated 2025-10-16 · CVE-2025-22258

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSRA versions 1.0.0 through 1.5.0 Fortinet FortiPAM versions 1.0.0 through 1.5.0 Fortinet FortiProxy versions 7.4.0 through 7.6.1 Fortinet FortiOS versions 7.0.2 through 7.6.2 Fortinet FortiSwitchManager versions 7.2.1 through 7.2.5

Description A heap-based buffer overflow exists in the software. Attackers can escalate their privileges by sending specially crafted http requests.

Recommendations Fortinet FortiSRA versions prior to 1.5.0 should be updated. Fortinet FortiPAM versions prior to 1.5.0 should be updated. Fortinet FortiProxy versions prior to 7.6.1 should be updated. Fortinet FortiOS versions prior to 7.6.2 should be updated. Fortinet FortiSwitchManager versions prior to 7.2.5 should be updated.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2026-05223

CVE-2025-22258

Affected Products

Fortios

Fortipam

Fortiproxy

Fortisra

Fortiswitchmanager

References · 7

• https://bdu.fstec.ru/vul/2026-05223 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22258 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22258 · Security Note
• https://t.me/CVEtracker/34860 · Telegram Post
• https://twitter.com/CVEnew/status/1978932602225725627 · Twitter Post
• https://t.me/cveNotify/138571 · Telegram Post