Fortinet FortiAP EUVD-2025-209803

Fortinet has released patched versions for FortiAP and FortiAP-W2; administrators must upgrade to FortiAP 7.6.3 or later for the 7.6 branch, 7.4.6 or later for the 7.4 branch, or verify latest patched versions in the 7.2 and 7.0 branches via the Fortinet advisory. Until patches can be deployed, implement the following compensating controls: restrict CLI access to FortiAP devices only to trusted network segments and disable remote CLI access if not required for operations. Enforce strong, unique administrative credentials and implement multi-factor authentication for administrative accounts if the FortiAP platform supports it. Monitor CLI command logs for unusual or suspicious commands, particularly those containing shell metacharacters or escape sequences. Limit the number of administrator accounts with full CLI privileges using the principle of least privilege - create role-based access controls that grant only necessary permissions. These controls introduce operational friction (monitoring overhead, potential latency from MFA) but substantially reduce the likelihood of unauthorized command injection exploitation. Consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-133 for the most current patch versions and detailed upgrade procedures.