Fortinet FortiOS CVE-2025-53847

Exploitation requires the attacker to occupy an adjacent network position relative to the FortiOS appliance (CVSS AV:A) - i.e., the same broadcast/L2 domain or a directly reachable interface, not arbitrary internet-based access - from which specially crafted packets are sent to a critical function that lacks an authentication check (CWE-306). No credentials (PR:N) and no user interaction (UI:N) are needed once adjacency exists. Limiting factors: the adjacency requirement substantially narrows the attacker population (excludes remote internet-only attackers hitting a properly segmented firewall); affected builds are specific (FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17, all 6.4, 6.2.9-6.2.17), so patched/other branches are unaffected; and there is no evidence of automation or active exploitation (SSVC Automatable=no, Exploitation=none).

Signals conflict in a way that pulls the real-world priority well below the 8.8 'High' headline. The CVSS vector grants full C:H/I:H/A:H impact and PR:N/UI:N (no authentication, no user interaction), consistent with CWE-306 missing authentication for a critical function that allows unauthorized code/command execution. However, the attack vector is AV:A (adjacent), not network - the attacker must already sit on the same adjacent/layer-2 segment or a directly reachable interface, which is a meaningful barrier for an internet-edge firewall product. Corroborating this lower-urgency read: EPSS is effectively floor-level at 0.01% (2nd percentile), and CISA's SSVC decision is Exploitation=none, Automatable=no, Technical Impact=partial. Note two internal tensions to verify: (1) SSVC rates Technical Impact as 'partial' while the CVSS vector claims total (C:H/I:H/A:H) impact - the 'partial' rating suggests the practical outcome may be narrower than full device takeover; and (2) there is no KEV listing and no public exploit. This reads as a genuine but not urgent issue: a real missing-auth flaw worth patching on a widely deployed security appliance, but one gated by adjacency and showing no exploitation traction. Prioritize patching, but it does not warrant emergency out-of-cycle response absent new exploitation evidence.

An attacker with a foothold on the same adjacent network segment as a FortiOS appliance (e.g., a compromised device on an internal VLAN or a directly connected management interface) sends specially crafted packets to a function that fails to enforce authentication, causing unauthorized command or code execution on the device. No credentials or user interaction are required once adjacency is achieved. No public exploit code or active exploitation has been identified at time of analysis.