テレワークなどの目的で多くの国内企業が利用する技術「SSL-VPN」が2026年5月以降、危険にさらされる恐れがある。米Fortinet（フォーティネット）が同社製VPN（仮想私設網）装置で提供してきたSSL-VPNの技術サポートを終了するためだ。

　独立行政法人情報処理推進機構（IPA）は10月15日、2025年第3四半期（7月から9月）における「脆弱性対策情報データベース『JVN iPedia』の登録状況」を発表した。

Cybersecurity Threat Advisory: Fortinet reveals a high-severity FortiOS vulnerability enabling command injection via improper CLI input validation.

Fortinet has disclosed a vulnerability affecting its FortiOS OS that could allow attackers with administrative privileges to execute unauthorized system commands.

Fortinetは現地時間2025年10月14日、「FortiOS」に関する複数の脆弱性を明らかにした。8月にゼロデイ脆弱性として発見し、「IPS」のシグネチャで防御していた脆弱性についても解消したという。 ：Security NEXT

Patchday auch bei Fortinet: Der Hersteller hat mehrere Lücken geschlossen, die für Bösewichte als Bestandteil einer Angriffs-Kill-Chain attraktiv sein könnten.

Patchday auch bei Fortinet: Der Hersteller hat mehrere Lücken geschlossen, die für Bösewichte als Bestandteil einer Angriffs-Kill-Chain attraktiv sein könnten.

A Serious Threat Hidden in the Firewall’s Core A newly revealed security flaw in FortiOS, the backbone operating system of Fortinet’s firewalls, has sent shockwaves through cybersecurity circles. The issue, identified as an “Incorrect Provision of Specified Functionality” (CWE-684), enables a local authenticated attacker to execute arbitrary system commands by crafting malicious CLI (command-line interface) inputs. This vulnerability, affecting multiple FortiOS versions from 6.4 through 7.6, threatens a massive spectrum of hardware devices—from entry-level FortiGate models to the company’s most powerful enterprise-grade appliances.

Fortinet disclosed a high-severity vulnerability in its FortiOS operating system on October 14, 2025, that could enable local authenticated attackers to execute arbitrary system commands. Tracked as CVE-2025-58325, the flaw stems from an incorrect provision of specified functionality (CWE-684) in the CLI component, potentially leading to privilege escalation. With a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), it poses significant risks to enterprise networks relying on Fortinet’s firewalls and security appliances. FortiOS CLI Command Bypass Vulnerability The issue arises when a local attacker with high privileges crafts malicious CLI commands, bypassing intended restrictions to run unauthorized system-level operations. This could result in full control over the device, data exfiltration, or further network compromise. No remote exploitation is possible, but the low attack complexity and high impact make it a prime target for insiders or compromised accounts. Francois Ropert from Fortinet’s PSIRT team discovered the flaw. Affected platforms include high-end models like the 100E/101E series up to the 7000F, while others remain untouched. Organizations should verify their setups immediately, as exploitation requires only local access and no user interaction. Fortinet urges upgrades to patched releases. The following table outlines impacted versions and fixes: FortiOS Version Affected Builds Recommended Solution 7.6 7.6.0 Upgrade to 7.6.1 or above 7.4 7.4.0 through 7.4.5 Upgrade to 7.4.6 or above 7.2 7.2.0 through 7.2.10 Upgrade to 7.2.11 or above 7.0 7.0.0 through 7.0.15 Upgrade to 7.0.16 or above 6.4 All versions Migrate to a fixed release Use Fortinet’s upgrade path tool for seamless transitions. No indicators of compromise (IoCs) or proof-of-concept exploits were released, but monitoring CLI logs for anomalies is advised. This incident, under FG-IR-24-361, underscores the need for least-privilege access in CLI management. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post FortiOS CLI Command Bypass Vulnerability Let Attacker Execute System Commands appeared first on Cyber Security News .

Certification updates can feel disruptive, especially when you’ve spent months preparing. The recent retirement of FCSS_EFW_AD-7.

Origin

量子コンピューティングは黎明期にあるにもかかわらず、機密データ、特に金融情報はすでに危険にさらされています。フォーティネットは新たな脅威から保護するための最先端のイノベーションとして、統合オペレーティングシステム「FortiOS」に量子安全機能を導入しました。

Origin

A high-severity authentication bypass vulnerability affecting multiple Fortinet security products, including FortiOS, FortiProxy, and FortiPAM systems.