Loading vulnerability…
Cross-Site Scripting in FortiADC Default Error Page
CVE-2025-58412 is a basic cross-site scripting vulnerability in Fortinet FortiADC caused by improper neutralization of script-related HTML tags in a web page. The flaw affects the virtual server's default error page and can be triggered via a crafted URL. Affected versions include FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, all versions of FortiADC 7.4, and all versions of FortiADC 7.2. The issue is exploitable by an unauthenticated attacker and results from insufficient sanitization of attacker-controlled input before it is reflected in the generated error page.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to execute malicious script in the context of a victim's browser when the crafted URL is processed and the vulnerable error page is rendered. This can enable session theft, unauthorized actions in the user interface, content injection, and access to sensitive information available to the affected web session, depending on the victim's privileges and browser context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the FortiADC web interface and virtual server error pages, restrict administrative and management access to trusted networks, and use compensating controls such as web application filtering, URL inspection, and monitoring for suspicious crafted requests targeting error handling paths. These measures are temporary and do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade FortiADC to a vendor-fixed release provided by Fortinet. Apply the security updates referenced in Fortinet's published advisories for this issue and ensure all affected FortiADC branches are moved to supported patched versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.