FortiOS
CVE-2025-22252: Missing authentication for critical function in FortiProxy, FortiSwitchManager and others
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiProxy 7.6.0 to 7.6.1 | 7.6.2 or later |
| FortiSwitchManager 7.2 | 7.2.6 or later |
| FortiOS 7.6 | 7.6.1 or later |
| FortiOS 7.4.4 to 7.4.6 | 7.4.7 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.