Fortinet FortiExtender CVE-2025-46776

Exploitation requires valid authenticated CLI access to a FortiExtender device (PR:L) and the ability to invoke the vulnerable CLI command path locally (AV:L); it cannot be triggered remotely or unauthenticated. Affected scope is FortiExtender 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2 and 7.0 versions. The principal limiting factors are the requirement for pre-existing credentials and local/management-plane access to the CLI, which confines risk to environments where untrusted or low-trust operators hold device accounts or where an attacker has already gained an initial foothold; no end-user interaction is required (UI:N).

This is a genuine but comparatively low-priority issue, best characterized as a high-severity local privilege-escalation/code-execution bug rather than a remotely-wormable threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a LOCAL attack vector requiring an already-authenticated low-privileged user, with full CIA impact (C:H/I:H/A:H) scoring 7.8. All exploitation signals point toward low real-world urgency: EPSS is only 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. No SSVC decision data was supplied. The signals are therefore consistent rather than conflicting - a locally-exploitable, authentication-gated flaw with near-zero observed exploitation probability. The main caveat is that CWE-120 buffer overflows via CLI are a well-worn path to privilege escalation on Fortinet appliances, so an authenticated low-privilege operator breaking out to full code execution is a meaningful trust-boundary violation even though it is not internet-facing. Treat this as a scheduled-patch item, not an emergency, unless untrusted users hold CLI accounts.

An authenticated user with low-privilege CLI access to a FortiExtender device issues specially crafted CLI commands that overflow a fixed-size buffer, corrupting memory to execute arbitrary code or OS commands with elevated privileges. Because the vector is local (AV:L) and requires valid credentials (PR:L), the attacker must already have a CLI account or a foothold on the device. No public proof-of-concept was identified at time of analysis.