Missing Authentication for critical function in CAPWAP daemon

criticalCVE-2025-53847

CVSSv3 Score: 6.2 A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, this attack requires the targeted FortiGate device to run a specific, non default configuration. Revised on 2026-04-14 00:00:00

CSIRTS triage

vendor: Fortinet product: FortiOS Privilege escalation

What: A missing authentication vulnerability allows a local unauthenticated attacker to write device configurations.
Who is affected: Local users on the same IP subnet as the affected FortiGate device.
Urgency: Remediation is critical due to the potential for unauthorized configuration changes.
Action: Apply the necessary updates to FortiOS and FortiSwitchManager.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiOS

Get an email when a new FortiOS advisory drops — max one per day, one-click unsubscribe.

Details

Source: Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)
Severity: critical
Published: 2026-04-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-125

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-538470.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-53847	coverage & exploitation status	NVD · CVE.org

Recent advisories for Missing Authentication for

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-40006: Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttl…nvd · 2026-07-10
mediumCVE-2026-33802: A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series all…nvd · 2026-07-09
mediumCVE-2026-31983: A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint…nvd · 2026-07-09
mediumCVE-2026-59804: Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authenticat…nvd · 2026-07-08
highCVE-2026-56002: A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.…nvd · 2026-07-08
criticalGHSA-pw9m-5jxm-xr6h: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provide…ghsa · 2026-07-07