CVE-2025-53847

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
FortinetFortiOS>= 7.6.0, <= 7.6.3; >= 7.4.0, <= 7.4.8; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.17; >= 6.4.0, <= 6.4.16; >= 6.2.9, <= 6.2.17
SiemensRUGGEDCOM APE1808< *

References

Timeline

Published
Apr 14, 2026
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-53859.8A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the fCVE-2025-538539.8A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchCVE-2025-538545.4A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A speciaCVE-2025-538557.8An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .fadeCVE-2025-538567.5When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded PackeCVE-2025-538573.7Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscCVE-2025-538584.8ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser oCVE-2025-538593.7NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read CVE-2025-53869.8A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /CVE-2025-538604.1A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security CVE-2025-538613.1A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and CCVE-2025-538623.5A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious