Medium 1 vendor · 2 advisories

CVE-2025-31366

CVE-2025-31366 key facts

CISA KEV: Not listed (catalogue checked Nov 11, 2026)
Highest advisory rating: Medium
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C · base score 4.5, scored by fortinetAttack vector: network. Attack complexity: high. Privileges required: none. User interaction: required. Scope: changed. Confidentiality impact: low. Integrity impact: low. Availability impact: none.
Weakness: CWE-79 Improper access control
EPSS: 0.40% chance of exploitation in the next 30 days (34th percentile). FIRST EPSS, Nov 10, 2026.
CISA SSVC: Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, Oct 14, 2025.
Vendor advisories: 2 from Fortinet
Assigned by: fortinet (CNA)
CVE record published: Oct 14, 2025
Listed by VulniPulse: Jul 14, 2026

Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2025-31366; each belongs to its advisory, not to every product listed. How records are collected and checked.

Description

An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.

Text from the CVE.org record (fortinet).

How do I fix CVE-2025-31366?

Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiOS version 7.4.9 or above Fortinet remediated this issue in FortiSASE version 25.3.b and hence customers do not need to perform any action. Upgrade to FortiProxy version 7.6.4 or above (CVE.org record)

Vendor advisories for CVE-2025-31366

Fortinet

2 advisories

Advisory severityMedium4.7
Medium [CVE-2025-31366 +1] Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0…
CVE-2025-31366Source published Oct 14, 2025Source updated Oct 14, 2025
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.
Affected products in this advisory
FortiOS
FortiProxy
FortiSASE
Source-reported affected versions
FortiOS: 6.4.0 through 7.6.3 (vendor-listed versions)
FortiProxy: 7.0.0 through 7.6.3 (vendor-listed versions)
FortiSASE: 25.2.a through 25.2.c (vendor-listed versions)
Source-reported fixed versions
FortiOS 7.6: 7.6.4
FortiOS 7.4: 7.4.9
FortiOS 7.2: migrate to a fixed release
FortiOS 7.0: migrate to a fixed release
5 more entries in the full advisory.
Mitigation guidance
Upgrade per the Affected/Solution table: FortiOS 7.6: 7.6.4; FortiOS 7.4: 7.4.9; FortiOS 7.2: migrate to a fixed release; FortiOS 7.0: migrate to a fixed release; FortiOS 6.4: migrate to a fixed release; ….
Full advisory and evidence Open source bulletin
Advisory severityMedium4.7
Medium [CVE-2025-31366 +1] URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS…
CVE-2025-47890Source published Oct 14, 2025Source updated Oct 14, 2025
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.
Affected products in this advisory
FortiOS
FortiProxy
FortiSASE
Source-reported affected versions
FortiOS: 6.4.0 through 7.6.3 (vendor-listed versions)
FortiProxy: 7.0.0 through 7.6.3 (vendor-listed versions)
FortiSASE: 25.2.a through 25.2.c (vendor-listed versions)
Source-reported fixed versions
FortiOS 7.6: 7.6.4
FortiOS 7.4: 7.4.9
FortiOS 7.2: migrate to a fixed release
FortiOS 7.0: migrate to a fixed release
5 more entries in the full advisory.
Mitigation guidance
Upgrade per the Affected/Solution table: FortiOS 7.6: 7.6.4; FortiOS 7.4: 7.4.9; FortiOS 7.2: migrate to a fixed release; FortiOS 7.0: migrate to a fixed release; FortiOS 6.4: migrate to a fixed release; ….
Full advisory and evidence Open source bulletin

References

Timeline

Oct 14, 2025CVE record published
Jul 14, 2026First vendor advisory listed by VulniPulse
Oct 15, 2026CVE record last updated

All Fortinet advisories

Get an email when Fortinet publishes the next one.

See Fortinet's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Fortinet

iPhone and Android apps · New on the App Store

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts on Android See app features