What is the CVSS score of CVE-2025-31365?

CVE-2025-31365 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-31365?

Within 24 hours, confirm the installed FortiClientMac version across all managed macOS endpoints, flag any host running 7.4.0-7.4.3 or 7.2.1-7.2.8 for remediation tracking, and reissue user guidance on not following unsolicited links or visiting untrusted sites; ensure endpoint detection and response coverage and browser/web-filtering protections are active on affected hosts. Within 7 days, enforce DNS and web filtering blocks against known-malicious domains, tighten browser security settings where feasible, brief the IT and security teams on the exposure and detection signatures for injected code execution originating from browsing activity, and open a vendor case to obtain a definitive fix version and timeline from Fortinet. Within 30 days, deploy the vendor-released FortiClientMac update across all macOS endpoints as soon as Fortinet publishes it, prioritizing 7.4.x and 7.2.x installations and any device used by executives, finance, or users with elevated local privileges; if no fix is available by then, escalate with the vendor, evaluate temporarily restricting the FortiClientMac components not required for business operations, and report residual risk to management with a documented exception.

FortiClientMac CVE-2025-31365

HIGH

Code Injection (CWE-94)

2025-10-14 psirt@fortinet.com

RCE Fortinet macOS Code Injection Forticlient

7.1

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure user to malicious website
Delivery

Deliver crafted web content
Exploit

Trigger code injection in FortiClientMac
Execution

Execute arbitrary code on macOS host
Impact

Compromise user endpoint

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires social engineering: the user must be tricked into visiting an attacker-controlled malicious website while running a vulnerable FortiClientMac build (7.4.0-7.4.3 or 7.2.1-7.2.8) on macOS - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication is required (PR:N), but the attacker does not get code execution against default configurations without the victim's browsing action; there is no server-side or unassisted remote path. Risk concentrates on endpoints whose users browse untrusted/external sites.
Impact	Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) describes a network-reachable flaw requiring no privileges but DEPENDENT on user interaction (UI:R) - the victim must be tricked into visiting a malicious website, which meaningfully lowers real-world exploitability versus a drive-by or server-side bug. EPSS reinforces low near-term risk at 0.28% (18th percentile), and the vulnerability is NOT in CISA KEV and has no identified public exploit, so there is no evidence of active exploitation. A notable internal tension exists: the description states an attacker 'may execute arbitrary code on the victim's host' (CWE-94), yet Fortinet scored impacts as only Low across confidentiality, integrity, and availability (C:L/I:L/A:L) - arbitrary code execution would normally imply High impacts, so the limited scoring likely reflects constrained/sandboxed execution context; verify the actual execution privilege with Fortinet FG-IR-25-037. No SSVC decision data was provided. Net: a real but not urgent issue - patch on a normal cycle, prioritizing hosts whose users browse untrusted sites.
Exploit ScenarioDerived	An attacker crafts a malicious web page and lures a FortiClientMac user (via phishing, malvertising, or a watering-hole link) into visiting it; the page delivers content that triggers the CWE-94 code-injection flaw in the client, executing attacker-controlled code on the macOS host. No public exploit code has been identified at time of analysis, and success depends on the user actually visiting the attacker's site (UI:R).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Code injection in FortiClientMac 7.4.0 through 7.4.3 and 7.2.1 through 7.2.8 on macOS could let an unauthenticated remote attacker execute arbitrary code on the victim’s host if the user is tricked into visiting a malicious website. The independent assessment emphasizes that exploitation requires social engineering and user interaction (UI:R), with mixed signals indicating a moderate rather than top-tier priority; EPSS is low at 0.28% (18th percentile), and no public exploit identified at time of analysis.

RemediationAI

Consult Fortinet PSIRT FG-IR-25-037 (https://fortiguard.fortinet.com/psirt/FG-IR-25-037) and apply the fixed FortiClientMac release for 7.4.x and 7.2.x once Fortinet publishes exact version guidance; the provided data does not specify a patched version, so patch availability is not confirmed from available data. Until an upgrade is available or deployed, reduce exposure by enforcing web filtering, DNS filtering, or blocklists to prevent users on affected macOS endpoints from reaching untrusted or attacker-controlled sites, and use browser isolation or separate hardened browsing environments for external websites where feasible; these controls reduce the social-engineering path but may affect user productivity and cannot fully eliminate risk if users can still visit malicious content. User awareness training is a supporting measure but not a substitute for patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

FortiClientMac is Fortinet’s endpoint security client for macOS. The flaw is CWE-94 (Improper Control of Generation of Code / Code Injection), where a component builds or handles executable logic or input without sufficient neutralization, allowing attacker-influenced code to run in the context of the client. The affected CPE entries are cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:* and a duplicate wildcard entry, identifying Fortinet FortiClient on macOS without pinning a specific version. NVD scores it CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, while the independent assessment scores CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; both agree the attack is network-reachable, low-complexity, unauthenticated, and requires the victim to visit a malicious website, but the independent assessment treats the resulting confidentiality, integrity, and availability impact as high while still noting user interaction as the main limiting factor.

Know when macOS gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI 8.8 HIGH

Remote and unauthenticated but gated by user visiting a malicious site (UI:R); CWE-94 arbitrary code execution justifies High C/I/A, scope unchanged as code runs in client context.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

DescriptionNVD

An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website.

Executive ViewAI

Why It Matters

A high-severity code injection flaw affects FortiClientMac endpoint agent versions 7.4.0-7.4.3 and 7.2.1-7.2.8 running on macOS, potentially allowing arbitrary code execution on an employee's machine. Because exploitation depends on convincing a user to visit a malicious website, the practical risk concentrates in workforce populations with liberal web browsing habits rather than in automated, network-wide attacks. With no vendor patch yet available and no public exploit identified at time of analysis, leadership should treat this as a manageable but time-sensitive exposure requiring interim controls and disciplined patch tracking.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce user awareness training and phishing/social-engineering guidance; deploy web filtering, DNS blocking, and browser hardening to prevent access to malicious sites; maintain active EDR with monitoring for injected code execution; restrict local administrative rights and apply least privilege on macOS endpoints; temporarily disable or limit non-essential FortiClientMac components where operationally feasible; track Fortinet advisories for a fixed release and validate any version prior to enterprise rollout.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Medium

macOS build of a widely-used enterprise endpoint client, narrower footprint than Windows

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.