CVE-2025-47761 HIGH

CVE-2025-47761

Vendor Fortinet
Product FortiClientWindows
Weakness CWE-782
Published November 18, 2025
Last update January 14, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

What the vulnerability does

01Description

An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.

Key dates

02Disclosure timeline

November 18, 2025 CVE published
January 14, 2026 Record updated