FortiClient Windows CVE-2025-57716

Exploitation is confined to the FortiClient Online Installer variant on Windows (versions 7.4.0-7.4.3, 7.2.0-7.2.11, and all 7.0 releases). The attacker must already possess a local low-privileged account on the host and have write access to the FortiClient Online Installer installation folder to drop the malicious DLL. Critically, the planted DLL only executes when the online installer is actually run (UI:R) - so exploitation depends on an operator or deployment process launching the installer, ideally at higher privilege for the attacker to gain anything. Limiting factors: no remote vector (AV:L), an existing local foothold is mandatory, the standard/non-online installer path is not indicated as affected, and the window of opportunity is tied to installer execution rather than being continuously available.

This is a genuinely HIGH-scored (CVSS 7.3) but comparatively low-urgency issue once all signals are weighed together. The CVSS vector itself is self-limiting: AV:L means no remote reachability, PR:L requires the attacker to already hold a low-privileged local account, and UI:R means a user (typically a more-privileged operator) must actually run the FortiClient Online Installer for the planted DLL to load. The high 7.3 is driven almost entirely by the full C:H/I:H/A:H impact of arbitrary code execution, not by ease of access. EPSS corroborates the low practical risk: 0.18% probability at the 7th percentile indicates exploitation is considered unlikely. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not an active-exploitation priority. The signals are internally consistent - there is no network-vs-local conflict here, as both the description (local user placing a DLL) and the CVSS vector (AV:L) agree on local-only exploitation. Net: a real local privilege-escalation / code-execution primitive worth patching on managed endpoints, but not an emergency relative to remotely exploitable flaws.

A local, low-privileged user on a Windows endpoint writes a malicious DLL into the FortiClient Online Installer installation folder. When the online installer is subsequently executed (e.g., by an administrator or an automated deployment running with higher privileges), the installer loads the attacker's DLL via an uncontrolled search path, executing attacker code in the installer's context. No public exploit code was identified at time of analysis; exploitation requires an existing local foothold plus the installer being run.