CVE-2025-31366: Fortinet FortiOS XSS Vulnerability

CVE-2025-31366 Overview

CVE-2025-31366 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting multiple Fortinet products. The flaw stems from improper neutralization of user input during web page generation. An unauthenticated attacker can deliver crafted HTTP requests that execute arbitrary JavaScript in a victim's browser context. Exploitation requires user interaction, such as clicking a malicious link. The vulnerability affects FortiOS, FortiProxy, and FortiSASE across several release trains.

Critical Impact
Successful exploitation allows an unauthenticated attacker to execute script in the victim's browser, potentially hijacking sessions or performing actions on the management interface with the victim's privileges.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions
Fortinet FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions
Fortinet FortiSASE 25.2.a

Discovery Timeline

2025-10-14 - CVE-2025-31366 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31366

Vulnerability Analysis

The vulnerability is a reflected XSS classified under [CWE-79]. Affected Fortinet web components return attacker-supplied input to the browser without proper output encoding. When a victim loads a crafted URL, the reflected payload executes in the origin of the Fortinet web interface. The attack does not require authentication, but user interaction is required to trigger the reflected payload. Scope is changed, meaning the vulnerable component impacts resources beyond its own security authority, such as the victim's browser session.

Root Cause

The root cause is missing or insufficient sanitization of input parameters processed by the FortiOS, FortiProxy, and FortiSASE web layer. User-supplied values reach HTML response contexts without contextual encoding, allowing HTML and JavaScript to be interpreted rather than rendered as literal text.

Attack Vector

An attacker crafts an HTTP request containing a malicious script payload targeting a vulnerable endpoint on the Fortinet management interface. The attacker delivers the URL via phishing, chat, or embedded links. When an authenticated administrator clicks the link, the browser executes the script under the trusted origin of the appliance web UI. The attacker can then read tokens, submit forms, or pivot within the administrative session. See the Fortinet Security Advisory FG-IR-24-542 for endpoint-level technical detail.

Detection Methods for CVE-2025-31366

Indicators of Compromise

HTTP requests to Fortinet management URLs containing encoded <script>, onerror=, onload=, or javascript: patterns in query parameters or fragments.
Web server access logs showing unusually long query strings or repeated parameter probing against management endpoints.
Referrer headers from external mail, chat, or web services pointing users to the appliance web UI.

Detection Strategies

Inspect web application firewall and reverse proxy logs for reflected-XSS signatures targeting FortiOS, FortiProxy, and FortiSASE administrative paths.
Correlate administrator browser sessions with unexpected outbound requests from the management network segment.
Alert on any access to the appliance web UI initiated from external referrers or embedded email links.

Monitoring Recommendations

Ingest Fortinet appliance HTTP logs into a centralized log platform and apply detections for XSS payload patterns.
Monitor administrator accounts for anomalous configuration changes shortly after web UI access from unusual clients.
Track outbound connections from admin workstations to unknown domains following management interface use.

How to Mitigate CVE-2025-31366

Immediate Actions Required

Upgrade FortiOS, FortiProxy, and FortiSASE to fixed versions as listed in Fortinet Security Advisory FG-IR-24-542.
Restrict access to the management interface to trusted administrative networks only.
Instruct administrators to avoid clicking links that lead to the appliance web UI from untrusted sources.

Patch Information

Fortinet has published fixed builds and remediation guidance in Fortinet Security Advisory FG-IR-24-542. Siemens references the same fix set in Siemens Product CERT SSA-864900. Apply the vendor-recommended upgrade path for each affected product line.

Workarounds

Disable the HTTP/HTTPS administrative interface on untrusted interfaces until patches are applied.
Enforce trusted-host restrictions on administrator accounts to limit which source IPs can reach the management UI.
Require administrators to use a dedicated browser or privileged access workstation isolated from general web browsing.

bash

# Restrict administrative access to trusted hosts on FortiOS
config system admin
  edit "admin"
    set trusthost1 10.0.0.0 255.255.255.0
  next
end

# Disable HTTP/HTTPS admin access on untrusted interfaces
config system interface
  edit "wan1"
    unset allowaccess
  next
end