What is the CVSS score of CVE-2025-53379?

CVE-2025-53379 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Fortiauthenticator are affected by CVE-2025-53379?

FortiAuthenticator authentication infrastructure (versions 6.5 and 6.6.0-6.6.2) is vulnerable to unauthenticated remote information disclosure attacks that expose sensitive authentication data stored…

How to fix or mitigate CVE-2025-53379?

Within 24 hours, identify and document all FortiAuthenticator instances running versions 6.5, 6.6.0, 6.6.1, or 6.6.2, and assess potential exposure of sensitive authentication credentials. Within 7 days, apply the latest vendor security patch to upgrade affected instances, or implement network access restrictions to limit external exposure if patching cannot be completed immediately. Within 30 days, verify all affected instances have been successfully patched and conduct a security audit to confirm no unauthorized access occurred during the vulnerability window.

Fortiauthenticator CVE-2025-53379

EUVD-2025-210464 HIGH

Out-of-bounds Read (CWE-125)

2026-07-14 fortinet

GHSA-xhc3-w35m-fp4q

Fortinet Buffer Overflow Information Disclosure Fortiauthenticator

7.5

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (fortinet) · only source for this CVE.

CVSS VectorVendor: fortinet

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 16:22 NVD

7.0 (HIGH) 7.5 (HIGH)

Analysis Generated

Jul 14, 2026 - 16:05 vuln.today

CVE Published

Jul 14, 2026 - 15:13 cve.org

HIGH 7.0

DescriptionCVE.org

A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

Articles & Coverage 1

News 4 New Fortinet Vulnerabilities - 4 High Severity Jul 15, 2026

AnalysisAI

Information disclosure in Fortinet FortiAuthenticator (6.5 all versions and 6.6.0–6.6.2) lets a remote unauthenticated attacker read out-of-bounds memory via a specially crafted request, exposing sensitive in-memory data. The CVSS temporal metrics (E:F, RC:C) indicate a functional, confirmed exploit is understood by the vendor, and an official fix is available (RL:O). No CISA KEV listing is present, so this is not confirmed as actively exploited despite the mature exploit signal.