An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Apple
  • Macos
Fortinet
  • Forticlient
  • Forticlientmac

Configuration 1 [-]

OR cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*
cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*

No data.

References
Link Providers
https://fortiguard.fortinet.com/psirt/FG-IR-25-126 cve-icon cve-icon
History

Wed, 14 Jan 2026 09:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:forticlientmac:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.4.2:*:*:*:*:*:*:*

Wed, 22 Oct 2025 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet forticlient
CPEs cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*
Vendors & Products Fortinet forticlient

Mon, 20 Oct 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Fortinet
Fortinet forticlientmac
Vendors & Products Apple
Apple macos
Fortinet
Fortinet forticlientmac

Tue, 14 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Oct 2025 15:45:00 +0000

Type Values Removed Values Added
Description An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.
Weaknesses CWE-347
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2025-10-14T15:23:47.725Z

Updated: 2026-01-14T09:17:59.755Z

Reserved: 2025-04-29T08:42:13.449Z

Link: CVE-2025-46774

cve-icon Vulnrichment

Updated: 2025-10-14T16:36:03.775Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-14T16:15:38.500

Modified: 2025-10-22T16:47:22.450

Link: CVE-2025-46774

cve-icon Redhat

No data.