CVE-2025-67862

unknowncovered by 1 sourcefirst seen 2026-06-09

CVSSv3 Score: 6.0 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands. Revised on 2026-06-09 00:00:00

CSIRTS triage

What: An authenticated admin can execute Lua scripts via crafted CLI commands.
Who is affected: Authenticated administrators of FortiOS and FortiProxy.
Urgency: Remediation is necessary due to the potential for unauthorized script execution.
Action: Restrict CLI access or apply patches when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2025-67862

Get an email if CVE-2025-67862 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownRestricted CLI escape using Luafortinet · 2026-06-09

External references

NVD record for CVE-2025-67862

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2025-67862 status](https://www.csirts.com/badge/CVE-2025-67862)](https://www.csirts.com/cve/CVE-2025-67862)