FortiDLP Agent CVE-2025-46752

Exploitation requires local access (AV:L) to a system running the FortiDLP agent and at least low privileges (PR:L) sufficient to read the agent's log files, where the enrollment code has been improperly logged (CWE-532). The core prerequisite is that a valid enrollment code is present in a readable log and can be re-used. Limiting factors: the attacker must already be on the host with some privilege, no remote unauthenticated path is indicated by the CVSS vector, and impact is limited to partial information disclosure (C:L/I:L, A:N). This substantially constrains real-world risk relative to a remotely exploitable flaw.

This is a low-to-moderate priority issue despite being a Fortinet product. The CVSS base score of 4.4 (Medium) is driven by a local attack vector (AV:L), low attack complexity (AC:L), and required privileges (PR:L), yielding only Low confidentiality and integrity impact (C:L/I:L) and no availability impact. The signals are mutually consistent and point AWAY from widespread risk: EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified. The vulnerability (CWE-532, sensitive information in a log file, exploitable by re-using an enrollment code) is an information-disclosure weakness that requires existing local access and some privilege level, not a remotely weaponizable flaw. No SSVC decision data was provided in the input. There is one point worth verifying: the CVSS vector specifies a LOCAL attack vector (AV:L), yet 're-using the enrollment code' could in some deployments imply a network-adjacent or enrollment-service interaction - the vendor advisory (FG-IR-25-160) should be consulted to confirm whether the enrollment code is consumed locally (e.g., written to a readable log) or exchanged over a network path. Treat this as routine-patch priority, not emergency.

An attacker with local, low-privilege access to a host running the FortiDLP agent reads agent log files where the enrollment code has been improperly recorded, then re-uses that captured enrollment code to disclose sensitive information. No public exploit code was identified at time of analysis, so exploitation would require manual effort against a specific installation.