Fortinet FortiAnalyzer CVE-2025-54973

Exploitation specifically requires that FortiAnalyzer be configured to use FortiCloud SSO authentication and that the attacker can reach the SSO request interface over the network. The attacker must win a timing-sensitive race condition (CWE-362) in the SSO authorization logic by issuing crafted, concurrent FortiCloud SSO requests, which is reflected as HIGH attack complexity (AC:H). Exploitation is further LIMITED by required user interaction (UI:R) - a legitimate/victim SSO action or concurrent flow is needed - and by the non-default dependency on FortiCloud SSO being enabled; deployments using only local authentication are not in scope. Affected builds are FortiAnalyzer 7.6.0-7.6.2, 7.4.0-7.4.6, 7.2.0-7.2.10, and all versions before 7.0.13.

This is a moderate-severity, lower-priority issue rather than a top-tier emergency. The official CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.3) describes a network-reachable, unauthenticated flaw but with HIGH attack complexity (AC:H) - inherent to CWE-362 race conditions, which require precise timing to win - and it also requires user interaction (UI:R), both of which materially reduce real-world exploitability. The EPSS score is low (0.32%, 22nd percentile), consistent with no observed widespread exploitation activity. The vulnerability is NOT listed in CISA KEV, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' These signals are mutually consistent: a race-condition SSO authorization bypass that is hard to win and needs user interaction is a plausible targeted-attack avenue but not a mass-exploitation candidate. One notable inconsistency to flag: for an 'authorization bypass' one would typically expect a confidentiality impact (C), yet the vendor vector sets C:N and only I:H - this likely reflects that winning the race lets an attacker assert/alter an authorization state (integrity of the auth decision) rather than directly reading data; verify the precise impact scope with Fortinet advisory FG-IR-25-198 before downgrading or upgrading priority. Overall: real but conditional risk, appropriate for scheduled patching rather than immediate incident response, barring exposure of FortiAnalyzer management/SSO interfaces to untrusted networks.

An attacker with network reachability to a FortiAnalyzer FortiCloud SSO interface sends a burst of crafted FortiCloud SSO requests timed to coincide with a legitimate user's SSO action, racing the improperly synchronized authorization check to slip through as an authorized session. Because the CVSS vector specifies high attack complexity and required user interaction, success depends on precise timing and a concurrent victim SSO flow. No public proof-of-concept exploit has been identified at time of analysis.