CVE-2025-22855 Cross-site scripting in FortiClientEMS

What is CVE-2025-22855?

CVE-2025-22855 is a low-severity cross-site scripting vulnerability in Fortinet FortiClientEMS, published on 8 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code.

Weakness: CWE-79

Which versions are affected by CVE-2025-22855?

It affects 1 product.

Products include Fortinet Forticlientems.

How do I fix CVE-2025-22855?

No fix has been published for CVE-2025-22855 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-22855 being exploited?

There is no known exploitation of CVE-2025-22855 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiClientEMS

• CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Exploited Critical 9.1
• CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Exploited Critical 9.1
• CVE-2024-23106 Auth bypass in FortiClientEMS High 7.7
• CVE-2025-59922 SQL injection in FortiClientEMS Medium 6.8
• CVE-2026-59836 Security feature bypass in FortiClientEMS Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-962v-6x3f-5mw4.