CVE-2025-53847
Published: 14 April 2026
Summary
CVE-2025-53847 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Fortinet Fortios. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-9 (Service Identification and Authentication).
Deeper analysis
CVE-2025-53847 is a missing authentication for critical function vulnerability (CWE-306) in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, all versions of 6.4, and 6.2.9 through 6.2.17. Published on 2026-04-14, it carries a CVSS v3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The issue enables attackers to execute unauthorized code or commands by sending specially crafted packets to affected systems.
Attackers positioned on an adjacent network (AV:A) can exploit this vulnerability with low attack complexity and no privileges or user interaction required. Successful exploitation allows execution of unauthorized code or commands, resulting in high integrity impact (I:H) while maintaining unchanged scope, potentially compromising the confidentiality or modification of system data without authentication checks.
Fortinet's PSIRT advisory FG-IR-26-125 at https://fortiguard.fortinet.com/psirt/FG-IR-26-125 provides detailed information on the vulnerability, including affected versions and recommended mitigations or patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209450
Vulnerability details
A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or…
more
commands via specially crafted packets.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on critical function in FortiOS directly enables unauthenticated remote code/command execution via crafted packets (RCE on network-exposed appliance).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses missing authentication for critical functions by requiring identification and limitation of permitted unauthenticated actions in FortiOS.
Mandates identification and authentication for system services, preventing unauthorized code execution via unauthenticated packet-based critical functions in FortiOS.
Remediates the specific flaw in FortiOS versions by identifying, reporting, and applying patches for the missing authentication vulnerability.