CVE-2025-53744

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-53758.8A vulnerability was found in PHPGurukul HPGurukul Online Birth Certificate System 2.0. It has been classified as critical. Affected is an un CVE-2025-537545.1This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firm CVE-2025-537555.1This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An CVE-2025-537568.7This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remo CVE-2025-537578.7This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associa CVE-2025-537585.1This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker CVE-2025-537597.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53769.8A vulnerability was found in SourceCodester Health Center Patient Record Management System 1.0. It has been declared as critical. Affected b CVE-2025-537607.1Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2025-537617.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-537629.9Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network.CVE-2025-537639.8Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.