Fortidlp Agent
Monthly
Local privilege escalation in Fortinet's FortiDLP Agent for macOS lets an authenticated local attacker escalate to root by sending a crafted request to a local listening port exposed by the Outlookproxy plugin. The flaw is a path traversal (CWE-22) in which the plugin mishandles a pathname, allowing the attacker to reach files or operations outside the intended restricted directory under the agent's privileged context. The affected versions are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1, on macOS endpoints only, and exploitation requires an existing local foothold (CVSS PR:L, AV:L, no user interaction). Per available intelligence there is no public exploit code, the vulnerability is not in CISA KEV, and EPSS is low at 0.21 percent (11th percentile), making this a credible but second-tier priority rather than an emergency.
Local privilege escalation in Fortinet's FortiDLP Agent on Windows (Outlookproxy plugin) allows an authenticated, low-privileged local user to elevate to the LocalService account by sending a crafted path-traversal request to the agent's local listening port. Affected builds include 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1, with CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS probability is low at roughly 0.21% (10th percentile), so this is a credible but not emergency-grade local escalation issue that requires an attacker to already hold a foothold on the host.
Local disclosure of a signed-in user's email information through the Outlookproxy plugin in Fortinet FortiDLP Agent on macOS and Windows, reachable only by an attacker who is already an authenticated administrator on the endpoint (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0, CWE-359). Affected releases are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1. Because the vector requires local access and high privileges, the realistic threat is insider misuse or post-compromise lateral activity on a managed host rather than remote attack; no public exploit identified at time of analysis, no KEV listing, and EPSS is 0.18% (7th percentile).
Information disclosure in FortiDLP Agent 12.0.0 through 12.0.5, 11.5.1, 11.4.6, and 11.4.5 allows local users with low privileges to read enrollment codes improperly written to log files and reuse them, causing limited confidentiality and integrity impact. Exploitation requires local access and readable logs; no public exploit identified at time of analysis, and EPSS is low at 0.16% (4th percentile). Fortinet advisory FG-IR-25-160 is available, and this is a low-to-moderate priority issue despite being a Fortinet product.
Local privilege escalation in Fortinet's FortiDLP Agent for macOS lets an authenticated local attacker escalate to root by sending a crafted request to a local listening port exposed by the Outlookproxy plugin. The flaw is a path traversal (CWE-22) in which the plugin mishandles a pathname, allowing the attacker to reach files or operations outside the intended restricted directory under the agent's privileged context. The affected versions are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1, on macOS endpoints only, and exploitation requires an existing local foothold (CVSS PR:L, AV:L, no user interaction). Per available intelligence there is no public exploit code, the vulnerability is not in CISA KEV, and EPSS is low at 0.21 percent (11th percentile), making this a credible but second-tier priority rather than an emergency.
Local privilege escalation in Fortinet's FortiDLP Agent on Windows (Outlookproxy plugin) allows an authenticated, low-privileged local user to elevate to the LocalService account by sending a crafted path-traversal request to the agent's local listening port. Affected builds include 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1, with CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS probability is low at roughly 0.21% (10th percentile), so this is a credible but not emergency-grade local escalation issue that requires an attacker to already hold a foothold on the host.
Local disclosure of a signed-in user's email information through the Outlookproxy plugin in Fortinet FortiDLP Agent on macOS and Windows, reachable only by an attacker who is already an authenticated administrator on the endpoint (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0, CWE-359). Affected releases are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1. Because the vector requires local access and high privileges, the realistic threat is insider misuse or post-compromise lateral activity on a managed host rather than remote attack; no public exploit identified at time of analysis, no KEV listing, and EPSS is 0.18% (7th percentile).
Information disclosure in FortiDLP Agent 12.0.0 through 12.0.5, 11.5.1, 11.4.6, and 11.4.5 allows local users with low privileges to read enrollment codes improperly written to log files and reuse them, causing limited confidentiality and integrity impact. Exploitation requires local access and readable logs; no public exploit identified at time of analysis, and EPSS is low at 0.16% (4th percentile). Fortinet advisory FG-IR-25-160 is available, and this is a low-to-moderate priority issue despite being a Fortinet product.