← Vulnerability feed

Vulnerability record · CVE-2025-46776 · published 18 November 2025

CVE-2025-46776: Fortinet fortiextender firmware classic buffer overflow vulnerability

Fortinet · Fortiextender Firmware

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.

7.8 CVSS 3.1 High EPSS 0.16% · top 96.0% CWE-120 · Classic buffer overflow
7.8CVSS 3.1 base score
0.16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://fortiguard.fortinet.com/psirt/FG-IR-25-251 Vendor Advisory

Track CVE-2025-46776 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-23663Fortinet fortiextender firmware improper access control vulnerabilityAn improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an at…EPSS 0.64%8.8CVE-2021-41016Fortinet fortiextender firmware os command injection vulnerabilityA improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and be…EPSS 1.1%7.5CVE-2022-23447Fortinet fortiextender firmware path traversal vulnerabilityAn improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 …EPSS 0.80%7.2CVE-2025-64153Fortinet fortiextender firmware os command injection vulnerabilityA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExte…EPSS 1.7%7.2CVE-2022-27489Fortinet fortiextender firmware os command injection vulnerabilityA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.…EPSS 1.5%5.5CVE-2025-46775Fortinet fortiextender firmware vulnerabilityA debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, Fo…EPSS 0.16%5.5CVE-2025-43520Apple OS kernel memory corruption via malicious appA memory corruption flaw (classic buffer overflow) in Apple's kernel was fixed across iOS, iPadOS, macOS, tvOS, visionOS and watchOS. A malicious app…KEVEPSS 0.43%analysed8.8CVE-2025-31277Apple WebKit memory corruption via malicious web contentApple WebKit fails to handle memory correctly when processing crafted web content, leading to memory corruption across Safari, iOS, iPadOS, macOS, tv…KEVEPSS 1.6%analysed

Source: NIST National Vulnerability Database (record CVE-2025-46776), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.