CVE-2025-48418

EUVD-2025-208484

10.03.2026, 18:17

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.7 MEDIUM	LOCAL	LOW	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
fortinet	CNA	6.4 MEDIUM	LOCAL	LOW	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
fortinet	fortimanager	6.4.0 ≤ 𝑥 < 7.0.15
fortinet	fortimanager	7.2.0 ≤ 𝑥 < 7.2.11
fortinet	fortimanager	7.4.0 ≤ 𝑥 < 7.4.8
fortinet	fortimanager	7.6.0 ≤ 𝑥 < 7.6.4
fortinet	fortimanager_cloud	6.4.1 ≤ 𝑥 < 7.0.15
fortinet	fortimanager_cloud	7.2.1 ≤ 𝑥 < 7.2.11
fortinet	fortimanager_cloud	7.4.1 ≤ 𝑥 < 7.4.8
fortinet	fortimanager_cloud	7.6.2 ≤ 𝑥 < 7.6.4
fortinet	fortianalyzer	6.4.0 ≤ 𝑥 < 7.0.15
fortinet	fortianalyzer	7.2.0 ≤ 𝑥 < 7.2.11
fortinet	fortianalyzer	7.4.0 ≤ 𝑥 < 7.4.8
fortinet	fortianalyzer	7.6.0 ≤ 𝑥 < 7.6.4
fortinet	fortianalyzer_cloud	6.4.1 ≤ 𝑥 < 7.0.15
fortinet	fortianalyzer_cloud	7.2.1 ≤ 𝑥 < 7.2.11
fortinet	fortianalyzer_cloud	7.4.1 ≤ 𝑥 < 7.4.8
fortinet	fortianalyzer_cloud	7.6.2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-912 - Hidden Functionality
The software contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the software's users or administrators.

Vulnerability Media Exposure

[GERMAN] Fortinet: Hochriskante Lücken in FortiWeb, FortiManager und weiteren
Fortinet schließt Lücken in FortiWeb oder FortiManager, die etwa Einschleusen von Befehlen erlauben. FortiGate-Firewalls wurden attackiert.
Published: 2026-03-11T11:47:00+00:00

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-081