FortiADC CVE-2025-59921

Requires a valid authenticated session on the FortiADC HTTP/HTTPS interface at low privilege (PR:L) - the attacker must already possess working credentials or a compromised low-level account; it is NOT exploitable by fully unauthenticated actors. Exploitation is performed via crafted HTTP or HTTPS requests, so the appliance's web/management interface must be network-reachable to the attacker. Affected versions are FortiADC 7.4.0, 7.2.3 and below, 7.1.4 and below, all 7.0 versions, and all 6.2 versions; upgrading to a fixed release per FG-IR-23-434 removes exposure. Key limiting factor: the authentication requirement and confidentiality-only impact (no integrity or availability effect) confine this to data leakage rather than appliance takeover.

This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low-privilege authentication, with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N) - consistent with CWE-200 information disclosure. The EPSS score is low at 0.30% (21st percentile), indicating a low modeled probability of exploitation in the near term, and the CVE is NOT listed in CISA KEV, with no public exploit identified at time of analysis. These signals align rather than conflict: a low-EPSS, non-KEV, authenticated-only disclosure flaw is a genuine but non-critical risk. The main caveat is that it requires an existing authenticated foothold (PR:L) on the management/service interface, which substantially limits blast radius versus an unauthenticated RCE. No SSVC decision data was provided in the input, so automatable/exploitation-maturity cannot be assessed from a formal framework beyond the EPSS and KEV signals above. Priority: patch in normal cadence, prioritizing internet-exposed management interfaces.

An attacker who already holds a low-privileged authenticated account on a FortiADC appliance sends specially crafted HTTP or HTTPS requests to the management or service interface and receives sensitive data back that the account should not be authorized to see. No public exploit code has been identified, and no user interaction or elevated privileges are required beyond the initial low-level authentication.