CVE-2025-46775 Information disclosure in FortiExtender

What is CVE-2025-46775?

CVE-2025-46775 is a medium-severity vulnerability in Fortinet FortiExtender, published on 18 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.

Weakness: CWE-1295

Which versions are affected by CVE-2025-46775?

It affects 1 product.

Products include Fortinet Fortiextender Firmware.

How do I fix CVE-2025-46775?

No fix has been published for CVE-2025-46775 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-46775 being exploited?

There is no known exploitation of CVE-2025-46775 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiExtender

• CVE-2024-23663 Privilege escalation in FortiExtender High 8.1
• CVE-2021-41016 Command injection in n/a High 7.8
• CVE-2022-23447 Path traversal in FortiExtender High 7.3
• CVE-2022-27489 Command injection in FortiExtender High 7.0
• CVE-2025-64153 Command injection in FortiExtender Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6vg5-gh5c-gr5c.