Unrated severityNVD Advisory· Published Oct 14, 2025· Updated Feb 26, 2026

CVE-2025-25253

Description

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy

Affected products

Fortinet/Fortiproxyv5
cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*
Range: 7.6.0
Fortinet/Fortiosv5
cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*
Range: 7.6.0
Fortinet/Fortipamv5
cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*
Range: 1.4.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

fortiguard.fortinet.com/psirt/FG-IR-24-457mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000