---
id: CVE-2025-22862
title: "An\_Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 a…"
summary: "An\_Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 a…"
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-288
vendor: Fortinet
product: FortiProxy
affected:
  - FortiProxy >= 7.6.0 <= 7.6.2
  - FortiProxy >= 7.4.0 <= 7.4.8
  - FortiProxy >= 7.2.0 <= 7.2.15
  - FortiProxy >= 7.0.5 <= 7.0.22
  - FortiOS >= 7.4.0 <= 7.4.7
  - FortiOS >= 7.2.0 <= 7.2.11
  - FortiOS >= 7.0.6 <= 7.0.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-10-03T03:55:34.469834Z'
published: '2025-10-02'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:05:40.587Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22862'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-385'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-385'
tags:
  - cve.org
epss: 0.00252
epssPercentile: 0.15506
ingestedAt: '2026-10-15T05:52:46.103Z'
---

## Overview

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

## Affected

- `FortiProxy >= 7.6.0 <= 7.6.2`
- `FortiProxy >= 7.4.0 <= 7.4.8`
- `FortiProxy >= 7.2.0 <= 7.2.15`
- `FortiProxy >= 7.0.5 <= 7.0.22`
- `FortiOS >= 7.4.0 <= 7.4.7`
- `FortiOS >= 7.2.0 <= 7.2.11`
- `FortiOS >= 7.0.6 <= 7.0.18`

## Remediation

Fortinet remediated this issue in FortiSASE version 25.2.a and hence customers do not need to perform any action.
Upgrade to FortiProxy version 7.6.3 or above
Upgrade to FortiProxy version 7.4.9 or above
Upgrade to FortiOS version 7.6.0 or above
Upgrade to FortiOS version 7.4.8 or above
Upgrade to FortiOS version 7.2.12 or above