PT-2026-24234 · Fortinet · Fortimanager

Published 2026-03-10 · Updated 2026-03-18 · CVE-2025-54820

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 7.2.0 through 7.2.10 Fortinet FortiManager versions 7.4.0 through 7.4.2 Fortinet FortiManager 6.4 all versions

Description A stack-based buffer overflow flaw exists in Fortinet FortiManager. A remote, unauthenticated attacker could potentially execute arbitrary commands by sending specially crafted requests, provided the service is enabled. Successful exploitation may depend on bypassing stack protection mechanisms.

Recommendations FortiManager versions 7.2.0 through 7.2.10 should be updated. FortiManager versions 7.4.0 through 7.4.2 should be updated. FortiManager 6.4 all versions should be updated.

Fix

RCE

Buffer Overflow

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-119

CWE-787

CWE-121

Related Identifiers

BDU:2026-02878

CVE-2025-54820

Affected Products

Fortimanager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-54820 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-098 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54820 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02878 · Security Note
• https://twitter.com/0dayPublishing/status/2031662397111312763 · Twitter Post
• https://twitter.com/threatcluster/status/2031445600613359637 · Twitter Post
• https://t.me/cveNotify/155372 · Telegram Post
• https://twitter.com/CVEnew/status/2034136479463559322 · Twitter Post
• https://twitter.com/dailycve/status/2032281533025759250 · Twitter Post