Fortinet FortiPAM CVE-2025-49201

Exploitation requires network reachability to the HTTP/HTTPS management interface of an affected build: FortiPAM 1.0 through 1.5.0 (specifically 1.5.0, 1.4.0-1.4.2, and all 1.1/1.2/1.3 releases) or FortiSwitchManager 7.2.0 through 7.2.4. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed once that interface is reachable, so the primary limiting factor is exposure: appliances whose management interface is restricted to trusted networks or not internet-facing substantially reduce real-world attack surface. The only hard prerequisites are a vulnerable version and HTTP access to the management service; no non-default feature toggle is named in the advisory description.

Multiple signals must be weighed together here and they partly conflict. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a worst-case profile: remote, network-reachable, no authentication, no user interaction, and full compromise of confidentiality, integrity, and availability - consistent with CWE-1390 (weak/improper authentication) allowing unauthorized code or command execution. Against that, the EPSS score is low at 0.58% (47th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is the classic 'high-CVSS, not-yet-proven-exploited' pattern: the theoretical impact is severe and the vulnerability sits on internet-facing security-management appliances (a historically attractive Fortinet target class), but the current empirical exploitation probability is modest. The disparity between a 9.8 severity and a sub-1% EPSS suggests the bug is serious-by-design but not yet widely weaponized - treat it as a high patch priority given Fortinet's history of appliance exploitation, while noting that no active-exploitation or POC signal currently corroborates the high base score. No SSVC decision data was provided in the input, so automatable/exploitation-status cannot be independently derived beyond the above.

An unauthenticated attacker with network access to a FortiPAM or FortiSwitchManager management interface sends specially crafted HTTP request(s) that abuse the weak authentication logic to bypass access controls and execute unauthorized code or commands on the appliance. Because CVSS shows AV:N/AC:L/PR:N/UI:N, no credentials, no user interaction, and only low attack complexity are required once the interface is reachable. No public proof-of-concept is referenced in the provided intelligence, so exploitation would currently require independent vulnerability research.