CVE-2025-22256HIGH 8.8EPSS p21.8%

CVE-2025-22256CVE-2025-22256

Description

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.30% probability of exploitation · percentile 21.8% · 2026-06-19T12:03:05Z
Published2025-06-10
Last modified2025-07-24

Underlying weaknesses· 1

CWE-280

References

  1. https://fortiguard.fortinet.com/psirt/FG-IR-25-008

1

TypeTargetConfidenceTier
WeaknessImproper Handling of Insufficient Permissions or Privilegescwe-2800%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-49201
CVE
CVE-2025-52970
CVE
CVE-2026-49938
CVE
CVE-2025-47855
CVE
Fortinet FortiOS Out-of-Bound Write Vulnerability
CVE
Fortinet FortiWeb Path Traversal Vulnerability
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.