{"api_version":"1","generated_at":"2026-10-24T01:56:11+00:00","cve":"CVE-2025-47761","urls":{"html":"https://cve.report/CVE-2025-47761","api":"https://cve.report/api/cve/CVE-2025-47761.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-47761","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-47761"},"summary":{"title":"CVE-2025-47761","description":"An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver.  Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.","state":"PUBLISHED","assigner":"fortinet","published_at":"2025-11-18 17:16:02","updated_at":"2026-10-18 20:10:00"},"problem_types":["CWE-782","CWE-782 Execute unauthorized code or commands"],"metrics":[{"version":"3.1","source":"psirt@fortinet.com","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","data":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","version":"3.1"}}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-112","name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-112","refsource":"psirt@fortinet.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47761","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47761","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindows","version":"affected 7.4.0 7.4.3 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindows","version":"affected 7.2.0 7.2.9 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to FortiClientWindows version 7.4.4 or above\nUpgrade to FortiClientWindows version 7.2.10 or above","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"47761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"forticlient","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-47761","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-18T21:11:44.141602Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-11-18T21:11:52.011Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindows","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.3","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver.  Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-782","description":"Execute unauthorized code or commands","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-01-14T09:17:43.864Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet"},"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-112","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-112"}],"solutions":[{"lang":"en","value":"Upgrade to FortiClientWindows version 7.4.4 or above\nUpgrade to FortiClientWindows version 7.2.10 or above"}]}},"cveMetadata":{"assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","assignerShortName":"fortinet","cveId":"CVE-2025-47761","datePublished":"2025-11-18T17:01:11.767Z","dateReserved":"2025-05-09T14:40:26.906Z","dateUpdated":"2026-01-14T09:17:43.864Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-11-18 17:16:02","lastModifiedDate":"2026-10-18 20:10:00","problem_types":["CWE-782","CWE-782 Execute unauthorized code or commands"],"metrics":{"cvssMetricV31":[{"source":"psirt@fortinet.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-18T21:11:44.141602Z","id":"CVE-2025-47761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.10","matchCriteriaId":"F9DAAE56-ACF6-464C-AF20-68D9FE2C31B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*","versionStartIncluding":"7.4.0","versionEndExcluding":"7.4.4","matchCriteriaId":"51121FCA-2CA9-4B4B-A27C-C4729AB797BB"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"47761","Ordinal":"1","Title":"CVE-2025-47761","CVE":"CVE-2025-47761","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"47761","Ordinal":"1","NoteData":"An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver.  Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.","Type":"Description","Title":"CVE-2025-47761"}]}}}