Loading vulnerability…
FortiADC External Resource Password Disclosure via Logs
CVE-2025-54971 is an exposure of sensitive information vulnerability in FortiADC logging. FortiADC may record passwords associated with configured external resources in product logs, allowing an administrator assigned read-only permissions to retrieve those passwords.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated read-only FortiADC administrator can disclose credentials for configured external resources. Compromise of those credentials may enable unauthorized access to the affected external services and facilitate further activity according to the privileges associated with the disclosed account.
If you can’t patch tonight, do this now.
Disable configured external resources until remediation is applied, where operationally feasible, to prevent their passwords from being exposed through FortiADC logs. Restrict read-only administrative access and review access to retained logs.
Patch, then assume compromise.
Upgrade FortiADC 7.4.0 to FortiADC 7.4.3 or later. Deploy a fixed release by migrating installations on the 7.2, 7.1, 7.0, and 6.2 release trains.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.