CVE-2025-22252: TACACS+ authentication bypass
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
Other sources
A missing authentication for critical function vulnerability [CWE-306] in FortiOS, FortiProxy, and FortiSwitchManager TACACS+ configured to use a remote TACACS+ server for authentication, that has itself been configured to use ASCII authentication may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22252?
CVE-2025-22252 is considered a critical vulnerability due to the missing authentication for critical functions.
How do I fix CVE-2025-22252?
To fix CVE-2025-22252, upgrade your FortiOS, FortiProxy, or FortiSwitchManager to the recommended version as outlined in the vendor's guidance.
What products are affected by CVE-2025-22252?
CVE-2025-22252 affects FortiOS, FortiProxy, and FortiSwitchManager when configured with a remote TACACS+ server using ASCII authentication.
What versions of Fortinet software should I upgrade to for CVE-2025-22252?
You should upgrade FortiOS to version 7.6.1 or later, FortiProxy to version 7.6.2 or later, and FortiSwitchManager to version 7.2.6 or later.
What type of attacks can exploit CVE-2025-22252?
Attackers may exploit CVE-2025-22252 to gain unauthorized access to critical functions due to the lack of proper authentication.