CVE-2025-31365: forticlient from 7.2.1 (inclusive), before 7.2.9 (exclusive), from 7.4.0 (inclusive), before 7.4.4 (exclusive); +1…

Affected technology

forticlient · from 7.2.1 (inclusive), before 7.2.9 (exclusive)
fortinet

forticlient · from 7.4.0 (inclusive), before 7.4.4 (exclusive)
fortinet

FortiClientMac · 7.4.0 through 7.4.3, 7.2.1 through 7.2.8
Fortinet

Description’s affected range: through 7.4.3, 7.2.1 through 7.2.8 may

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An unauthenticated attacker may execute arbitrary code on the victim's host via tricking the user into visiting a malicious website. Vendor/CNA’s CVSS 3.1 assessment (base score 5.8/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality, integrity and availability impact as low.