Loading vulnerability…
FortiOS, FortiProxy, and FortiPAM Trusted Host Policy Bypass
CVE-2025-54821 is an improper privilege management vulnerability in the CLI of FortiOS, FortiProxy, and FortiPAM. An authenticated administrator can use a crafted CLI command to bypass the trusted-host policy, which is intended to restrict the source hosts permitted to access administrative services. Affected releases include FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, all FortiOS 7.2, 7.0, and 6.4 releases, FortiPAM 1.6.0 and all 1.0 through 1.5 releases, and FortiSASE 25.2.91; FortiProxy is also identified as affected, but specific affected versions are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated administrator can circumvent trusted-host administrative access restrictions. This weakens source-based controls over management access and may enable administrative access from hosts that should be excluded by the trusted-host policy, resulting in privilege escalation or unauthorized management access paths.
If you can’t patch tonight, do this now.
No separate workaround is available. Prioritize migration to fixed releases and restrict administrative CLI access to tightly controlled management networks until patching is complete.
Patch, then assume compromise.
Upgrade FortiOS 7.6.0 through 7.6.3 to FortiOS 7.6.4 or later, FortiOS 7.4.0 through 7.4.11 to FortiOS 7.4.12 or later, and FortiPAM 1.6.0 to FortiPAM 1.6.1 or later. Migrate affected FortiOS 7.2, 7.0, and 6.4 releases, FortiPAM 1.0 through 1.5 releases, and FortiSASE 25.2.91 to applicable vendor-fixed releases. Apply the corresponding FortiProxy fixed release specified by Fortinet.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.