FortiDLP Agent CVE-2025-53951

Exploitation requires that the FortiDLP Agent with the Outlookproxy plugin is installed and running on a Windows host, exposing a local listening port, and that the attacker already holds authenticated low-privileged local access to that host (per CVSS PR:L and the description's 'authenticated attacker'). The attack is purely local - the crafted path-traversal request must be delivered to the local listening port, so there is no network-facing exposure. Limiting factors: no remote reachability, the agent and the specific Outlookproxy plugin must be deployed, and the host must run an affected version (11.5.1; 11.4.2-11.4.6; 11.3.2-11.3.4; 11.2.0-11.2.3; 11.1.1-11.1.2; 11.0.1; 10.5.1; 10.4.0; 10.3.1). No end-user interaction is required once local authenticated access is obtained.

This is a credible but not emergency-grade local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user, with low attack complexity and full C/I/A impact - consistent with the description's 'authenticated attacker may escalate their privilege to LocalService.' Signals agree that this is NOT remotely exploitable: the attacker must already have a foothold on the host and send a crafted request to a locally listening port. Exploitation signals are weak: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified - so this is a real, patch-worthy local EoP but not evidence of widespread or active exploitation. No SSVC decision data was provided in the input, so exploitation-status/automatable/technical-impact cannot be independently cross-referenced. Net: treat as a routine-to-moderate priority local privesc - important on hosts where untrusted users have local access, lower priority on single-admin endpoints. No conflicting signals were found; the CVSS local vector matches the description's 'local listening port' mechanism.

A low-privileged but authenticated user already logged into a Windows endpoint running the FortiDLP Agent sends a crafted path-traversal request to the Outlookproxy plugin's local listening port, abusing CWE-22 to escape the intended directory and have the request processed in the LocalService security context. This yields privilege escalation from the standard user to LocalService on that host. No public proof-of-concept exploit was identified at time of analysis.