CVE-2025-68482

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to view confidential information via a man in the middle [MiTM] attack.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Fortinet	FortiAnalyzer	>= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.8; >= 7.2.0, <= 7.2.12; >= 7.0.0, <= 7.0.16; >= 6.4.0, <= 6.4.15
Fortinet	FortiManager	>= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.8; >= 7.2.0, <= 7.2.12; >= 7.0.0, <= 7.0.16; >= 6.4.0, <= 6.4.15
Fortinet	FortiManager Cloud	>= 7.6.2, <= 7.6.3; >= 7.4.1, <= 7.4.7; >= 7.2.1, <= 7.2.10; >= 7.0.1, <= 7.0.14; >= 6.4.1, <= 6.4.7
Fortinet	FortiAnalyzer Cloud	7.6.2; >= 7.4.1, <= 7.4.7; >= 7.2.1, <= 7.2.10; >= 7.0.1, <= 7.0.14; >= 6.4.1, <= 6.4.7

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-078Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-68494.1A vulnerability, which was classified as problematic, was found in code-projects Simple Forum 1.0. Affected is an unknown function of the fi CVE-2025-684922.3Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploit CVE-2025-684938.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str CVE-2025-684945.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addo CVE-2025-684957.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows CVE-2025-684967.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback CVE-2025-684975.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-w CVE-2025-684986.5Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2025-684996.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM CVE-2025-68508.8A vulnerability has been found in code-projects Simple Forum 1.0 and classified as critical. Affected by this vulnerability is an unknown fu CVE-2025-685004.9Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Si CVE-2025-685017.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce