{"api_version":"1","generated_at":"2026-10-24T00:52:05+00:00","cve":"CVE-2025-59921","urls":{"html":"https://cve.report/CVE-2025-59921","api":"https://cve.report/api/cve/CVE-2025-59921.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-59921","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-59921"},"summary":{"title":"CVE-2025-59921","description":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests.","state":"PUBLISHED","assigner":"fortinet","published_at":"2025-10-14 16:15:41","updated_at":"2026-10-08 11:10:00"},"problem_types":["CWE-200","NVD-CWE-noinfo","CWE-200 Information disclosure"],"metrics":[{"version":"3.1","source":"psirt@fortinet.com","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.2","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","version":"3.1"}}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-434","name":"https://fortiguard.fortinet.com/psirt/FG-IR-23-434","refsource":"psirt@fortinet.com","tags":["Broken Link"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59921","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59921","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Fortinet","product":"FortiADC","version":"affected 7.4.0","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiADC","version":"affected 7.2.0 7.2.3 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiADC","version":"affected 7.1.0 7.1.4 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiADC","version":"affected 7.0.0 7.0.6 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiADC","version":"affected 6.2.0 6.2.6 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to FortiADC version 7.4.1 or above\nUpgrade to FortiADC version 7.2.4 or above\nUpgrade to FortiADC version 7.1.5 or above","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"59921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiadc","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-59921","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-10-14T17:35:23.426428Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-10-14T17:35:30.510Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.1.4:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.6:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*","cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiADC","vendor":"Fortinet","versions":[{"status":"affected","version":"7.4.0"},{"lessThanOrEqual":"7.2.3","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.1.4","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2.6","status":"affected","version":"6.2.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"Information disclosure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-01-14T09:17:57.893Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet"},"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-23-434","url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-434"}],"solutions":[{"lang":"en","value":"Upgrade to FortiADC version 7.4.1 or above\nUpgrade to FortiADC version 7.2.4 or above\nUpgrade to FortiADC version 7.1.5 or above"}]}},"cveMetadata":{"assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","assignerShortName":"fortinet","cveId":"CVE-2025-59921","datePublished":"2025-10-14T15:23:42.754Z","dateReserved":"2025-09-23T12:51:54.672Z","dateUpdated":"2026-01-14T09:17:57.893Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-14 16:15:41","lastModifiedDate":"2026-10-08 11:10:00","problem_types":["CWE-200","NVD-CWE-noinfo","CWE-200 Information disclosure"],"metrics":{"cvssMetricV31":[{"source":"psirt@fortinet.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-14T17:35:23.426428Z","id":"CVE-2025-59921","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"7.1.5","matchCriteriaId":"5D24E0A5-DCC9-406E-B9C9-DBA37E728A7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.4","matchCriteriaId":"EEF4EE14-8BCF-425A-9A49-1CF82BD47573"},{"vulnerable":true,"criteria":"cpe:2.3:a:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*","matchCriteriaId":"7C624CB5-F745-4781-839A-B397EC97590B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"59921","Ordinal":"1","Title":"CVE-2025-59921","CVE":"CVE-2025-59921","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"59921","Ordinal":"1","NoteData":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests.","Type":"Description","Title":"CVE-2025-59921"}]}}}