CVE-2025-64157: 
FortiOS vulnerability analysis and mitigation

CVE-2025-64157 is a Use of Externally-Controlled Format String vulnerability (CWE-134) in Fortinet FortiOS, specifically within the CAPWAP fast-failover mode component. It allows an authenticated administrator to execute unauthorized code or commands via specially crafted configuration. Affected versions include FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.0–7.2.11, and all FortiOS 7.0 versions; FortiOS 6.4 is not affected. The vulnerability was internally discovered and reported by Yonghui Han of the Fortinet Product Security team, with initial publication on February 10, 2026. The CVSS v3.1 base score is 6.7 (Medium) per the vendor advisory, though some sources report 7.2 (High) (FortiGuard Advisory).

The vulnerability is classified as CWE-134 (Use of Externally-Controlled Format String), located in the CLI component associated with CAPWAP fast-failover mode configuration in FortiOS. An attacker with authenticated administrator-level access can supply a maliciously crafted configuration string that is passed unsanitized to a format string function, enabling arbitrary code or command execution. Exploitation requires network access and high privileges (authenticated admin), with no user interaction needed. A virtual patch named "FG-VD-59445.0day" is available in FMWP database update 26.010 as an interim mitigation (FortiGuard Advisory).

Successful exploitation allows an authenticated administrator to execute unauthorized code or commands on the affected FortiOS system, resulting in complete system compromise. The impact spans all three security dimensions: confidentiality (unauthorized information disclosure), integrity (unauthorized modification of system data and configuration), and availability (potential system disruption). Given that FortiGate devices are typically deployed as network security perimeter controls, compromise could enable an attacker to pivot into protected network segments or disable security enforcement (FortiGuard Advisory).

As of the publication date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (FortiGuard Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.006% (0.000060), indicating a very low probability of exploitation in the near term (Feedly). Exploitation requires authenticated administrator access, which significantly limits the attack surface compared to unauthenticated vulnerabilities.

Fortinet recommends upgrading to the following fixed releases: FortiOS 7.6.5 or above (for 7.6.x), FortiOS 7.4.10 or above (for 7.4.x), and migrating to a fixed release for FortiOS 7.2.x and 7.0.x. Administrators should use the Fortinet upgrade path tool at https://docs.fortinet.com/upgrade-tool to plan their upgrade. As an interim measure, a virtual patch ("FG-VD-59445.0day") is available in FMWP database update 26.010. Additionally, restricting administrative access to trusted personnel, reviewing and disabling unnecessary admin accounts, and monitoring configuration changes are recommended compensating controls (FortiGuard Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Fortinet products that could allow arbitrary code execution, referencing this CVE among others (CIS Advisory). Belgium's Centre for Cybersecurity (CCB) also issued a warning urging immediate patching of affected Fortinet products. No significant independent researcher commentary or social media discussion has been identified for this specific CVE, consistent with its medium severity rating and the requirement for authenticated admin access.