CVE-2025-53844

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.6.0, <= 7.6.3; >= 7.4.0, <= 7.4.8; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.17; >= 6.4.0, <= 6.4.16; >= 6.2.0, <= 6.2.17; >= 6.0.0, <= 6.0.18
Siemens	RUGGEDCOM APE1808	< *

References

Timeline

Published: May 12, 2026
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-538456.5An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthen CVE-2025-538478.8A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7 CVE-2025-53859.8A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the f CVE-2025-538539.8A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-538545.4A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A specia CVE-2025-538557.8An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .fade CVE-2025-538567.5When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packe CVE-2025-538573.7Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subsc CVE-2025-538584.8ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser o CVE-2025-538593.7NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read CVE-2025-53869.8A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /CVE-2025-538604.1A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security