CVE-2025-22855 Overview
CVE-2025-22855 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Fortinet FortiClientEMS. The flaw stems from improper neutralization of input during web page generation. An authenticated EMS administrator can craft messages that contain JavaScript, which executes in the browser context of recipients.
Fortinet FortiClientEMS versions prior to 7.4.1 are affected. Exploitation requires high privileges and user interaction, limiting the practical attack surface. The vulnerability received a CVSS 3.1 score of 4.8 (Medium).
Critical Impact
An authenticated EMS administrator can inject JavaScript into administrative messages, enabling script execution against recipient browsers and potential compromise of the management session.
Affected Products
- Fortinet FortiClientEMS versions before 7.4.1
- Fortinet FortiClientEMS 7.2.x (all versions prior to fix)
- Fortinet FortiClientEMS 7.0.x (all versions prior to fix)
Discovery Timeline
- 2025-04-08 - CVE-2025-22855 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22855
Vulnerability Analysis
FortiClientEMS provides a centralized management console for FortiClient endpoints. The affected component allows administrators to send messages to managed endpoints or other console users. The message rendering path fails to neutralize HTML and JavaScript content before writing it into the generated web page.
When a recipient views the message, the browser parses attacker-controlled markup as active content. Script execution occurs in the origin of the FortiClientEMS console. The attacker must already hold administrator privileges on the EMS instance, and a victim must load the rendered page for the payload to fire.
Successful exploitation can lead to session token theft, coerced administrative actions through cross-site request forgery, or manipulation of the console UI presented to other operators. The scope change component in the CVSS vector reflects that impact extends beyond the vulnerable component itself.
Root Cause
The root cause is missing output encoding on user-supplied message content. The application accepts arbitrary strings from the administrator input path and inserts them into HTML responses without contextual escaping. This is a classic CWE-79 pattern where server-side rendering does not sanitize or encode fields that ultimately become part of the DOM.
Attack Vector
The attack vector is network-based and requires a compromised or malicious administrator account. The attacker authenticates to FortiClientEMS, composes a message containing JavaScript, and delivers it through the messaging feature. When another administrator or endpoint operator opens the message, the injected script runs. See the Fortinet Security Advisory FG-IR-23-344 for the vendor description.
No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability sits at 0.344% as of the most recent scoring cycle.
Detection Methods for CVE-2025-22855
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes appearing in stored EMS message records or audit logs.
- Administrator sessions performing unusual API calls immediately after opening a message from another administrator.
- Browser console errors or Content Security Policy violations generated when EMS console pages render message content.
Detection Strategies
- Review FortiClientEMS audit logs for message creation events initiated by administrator accounts, focusing on payload length and non-printable characters.
- Inspect stored message content in the EMS database for HTML tags, JavaScript event handlers, and encoded script markers such as <script.
- Correlate administrator authentication events with subsequent message-sending actions to identify suspicious operator behavior.
Monitoring Recommendations
- Enable verbose logging on the FortiClientEMS management interface and forward logs to a centralized analytics platform for retention and query.
- Monitor for privilege changes, new administrator account creation, and password resets on EMS instances following any suspicious message activity.
- Alert on outbound HTTP requests from administrator workstations to unknown domains shortly after console usage, which can indicate exfiltration through injected script.
How to Mitigate CVE-2025-22855
Immediate Actions Required
- Upgrade FortiClientEMS to version 7.4.1 or later as specified in the vendor advisory.
- Audit the FortiClientEMS administrator account inventory and remove unused or over-privileged accounts.
- Enforce multi-factor authentication for all FortiClientEMS administrator logins to reduce the risk of account takeover.
Patch Information
Fortinet released fixed builds in FortiClientEMS 7.4.1 and later. Consult the Fortinet Security Advisory FG-IR-23-344 for the complete list of fixed versions and upgrade guidance. Apply the patch through the standard FortiClientEMS upgrade process and validate console functionality after deployment.
Workarounds
- Restrict administrative access to FortiClientEMS to a limited set of trusted operators until the patch is applied.
- Limit management interface exposure to internal networks or a dedicated management VLAN and block internet-facing access.
- Advise administrators to avoid opening messages from unfamiliar or unverified EMS accounts during the remediation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
