FortiClient CVE-2025-46774

Exploitation requires an attacker to already be an authenticated local user on a macOS endpoint running a vulnerable FortiClient installer (version 7.4.2 or below, 7.2.9 or below, or any 7.0 version); there is no remote or network-based vector. The core precondition is the installer's improper verification of the cryptographic signature of FortiClient-related executables, allowing a locally-placed or substituted executable to be trusted and run with elevated privileges. Limiting factors: no user interaction by a victim is needed (UI:N), but local access plus low-level privileges (PR:L) are mandatory, the platform is restricted to macOS, and installations updated beyond the affected versions are not vulnerable - this confines realistic risk to multi-user or already-compromised Mac endpoints.

This is a locally-exploitable privilege escalation (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) in the FortiClient macOS installer stemming from improper cryptographic signature verification (CWE-347) of FortiClient-related executables. The signals are internally consistent but point to moderate real-world urgency rather than an emergency: the CVSS attack vector is Local and requires a low-privileged authenticated user already on the host, so this is a post-compromise escalation primitive, not a remote entry point. The EPSS score of 0.08% (0th percentile) indicates essentially no observed exploitation activity, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The high C/I/A impact reflects that successful exploitation yields elevated (likely root) privileges on macOS, which is serious, but the local-only, authentication-required precondition substantially limits the realistic threat to scenarios where an attacker or malware already has a foothold. No key signals conflict here - low EPSS, no KEV, and no POC all align with the local/authenticated CVSS vector. Priority should be driven by how widely FortiClient for macOS is deployed in the environment and whether untrusted local users share those endpoints.

A low-privileged local user (or malware running in that user's context) on a macOS endpoint running a vulnerable FortiClient installer version plants or substitutes a FortiClient-related executable that the installer fails to properly verify the signature of, causing a privileged FortiClient component to execute attacker-controlled code and escalate to elevated/root privileges. No public exploit code is identified at time of analysis, and the attack is confined to users who already have local access to the machine.