CVE-2025-54821 - An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command

Back Back to CVE browser

MEDIUM

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command

Published Nov 18, 2025

6.0

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

Affected products

Vendor Fortinet Product FortiOS Default
unaffected
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.16
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.19
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.13
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.11
- Version
  7.6.0
  Status
  affected
  Constraints
  <=7.6.3
Vendor Fortinet Product FortiPAM Default
unaffected
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.0.3
- Version
  1.1.0
  Status
  affected
  Constraints
  <=1.1.2
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.3.0
  Status
  affected
  Constraints
  <=1.3.1
- Version
  1.4.0
  Status
  affected
  Constraints
  <=1.4.3
- Version
  1.5.0
  Status
  affected
  Constraints
  <=1.5.1
- Version
  1.6.0
  Status
  affected
  Constraints
  -
Vendor Fortinet Product FortiSASE Default
unaffected
- Version
  25.2.91
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiOS

unaffected

Version	Status	Constraints
6.4.0	affected	<=6.4.16
7.0.0	affected	<=7.0.19
7.2.0	affected	<=7.2.13
7.4.0	affected	<=7.4.11
7.6.0	affected	<=7.6.3

Fortinet

FortiPAM

unaffected

Version	Status	Constraints
1.0.0	affected	<=1.0.3
1.1.0	affected	<=1.1.2
1.2.0	affected	-
1.3.0	affected	<=1.3.1
1.4.0	affected	<=1.4.3
1.5.0	affected	<=1.5.1
1.6.0	affected	-

Fortinet

FortiSASE

unaffected

Version	Status	Constraints
25.2.91	affected	-

Remediation

Vendor solution

Fortinet remediated this issue in FortiSASE version 25.3.b and hence customers do not need to perform any action. Upgrade to FortiOS version 8.0.0 or above Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiOS version 7.4.12 or above Upgrade to FortiProxy version 7.6.4 or above Upgrade to upcoming FortiProxy version 7.4.14 or above Upgrade to FortiPAM version 1.7.0 or above Upgrade to FortiPAM version 1.6.1 or above

Weaknesses (1)

CWE-269

Improper Privilege Management

References (3)

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/html/ssa-864900.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198008		Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-25-545		Vendor Advisory