PT-2026-7276 · Fortinet · Fortios

Published 2026-02-10 · Updated 2026-02-12 · CVE-2025-64157

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.0 through 7.2.11 Fortinet FortiOS versions 7.4.0 through 7.4.9 Fortinet FortiOS versions 7.6.0 through 7.6.4

Description An issue exists in Fortinet FortiOS where a use of externally-controlled format string can allow an authenticated administrator to execute unauthorized code or commands. This is possible through specifically crafted configuration.

Recommendations Fortinet FortiOS versions 7.0 through 7.2.11 should be updated. Fortinet FortiOS versions 7.4.0 through 7.4.9 should be updated. Fortinet FortiOS versions 7.6.0 through 7.6.4 should be updated.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2026-01820

CVE-2025-64157

Affected Products

Fortios

References · 6

• https://fortiguard.fortinet.com/psirt/FG-IR-25-795 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01820 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64157 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-975644.html · Note
• https://t.me/cveNotify/151833 · Telegram Post