CVE-2025-47761: Fortinet FortiClient Privilege Escalation

CVE-2025-47761 Overview

CVE-2025-47761 is an Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] affecting the fortips driver in Fortinet FortiClient for Windows. The flaw allows an authenticated local user to execute unauthorized code through improperly protected IOCTL handlers. Successful exploitation requires an active and running VPN IPSec connection, along with bypassing Windows memory protections such as heap integrity checks and Heap Segment Protection (HSP). Fortinet published the advisory on November 18, 2025 under reference FG-IR-25-112.

Critical Impact
A local authenticated attacker can escalate privileges and execute arbitrary code in the context of the fortips kernel driver, compromising confidentiality, integrity, and availability of the affected Windows host.

Affected Products

Fortinet FortiClientWindows 7.4.0 through 7.4.3
Fortinet FortiClientWindows 7.2.0 through 7.2.9
Installations with an active VPN IPSec connection using the fortips driver

Discovery Timeline

2025-11-18 - CVE-2025-47761 published to NVD and disclosed by Fortinet in advisory FG-IR-25-112
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47761

Vulnerability Analysis

The vulnerability resides in the fortips kernel-mode driver shipped with FortiClient for Windows. The driver exposes IOCTL (Input/Output Control) handlers that lack sufficient access control, allowing a low-privileged local user to send crafted requests that the driver processes without adequate validation. Because the driver operates in kernel space, unauthorized IOCTL invocations can be leveraged to corrupt kernel memory and hijack execution.

Exploitation is gated by two runtime conditions. First, a valid and running VPN IPSec tunnel must exist, since the vulnerable code paths within fortips are only reachable when the driver is actively processing tunnel traffic. Second, the attacker must bypass Windows exploit mitigations, including heap integrity validation and Heap Segment Protection. These preconditions elevate attack complexity but do not prevent exploitation by a skilled adversary.

Root Cause

The root cause is an insufficient access control check on an exposed device IOCTL, categorized under CWE-782 (Exposed IOCTL with Insufficient Access Control). The driver does not adequately restrict which callers can invoke sensitive IOCTL codes, permitting non-administrative processes to reach privileged handlers.

Attack Vector

The attack vector is local. An authenticated user on the target Windows endpoint opens a handle to the fortips device object and issues crafted DeviceIoControl requests. Combined with a memory-corruption primitive and a mitigation bypass, this grants arbitrary code execution in kernel context. Public exploit code is not available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Fortinet Security Advisory FG-IR-25-112 for vendor technical details.

Detection Methods for CVE-2025-47761

Indicators of Compromise

Unexpected user-mode processes opening handles to the \\.\fortips device object outside of the FortiClient service context
Windows kernel crashes or bugchecks referencing the fortips.sys driver on hosts running vulnerable FortiClient versions
Creation of new privileged processes or services immediately following FortiClient VPN IPSec session activity from non-administrative accounts

Detection Strategies

Inventory endpoints for FortiClient versions in the 7.4.0–7.4.3 and 7.2.0–7.2.9 ranges and flag them as vulnerable until patched
Hunt for anomalous DeviceIoControl calls targeting the fortips driver from processes not signed by Fortinet
Correlate VPN IPSec tunnel establishment events with subsequent local privilege escalation indicators such as token manipulation or new administrator group membership

Monitoring Recommendations

Enable kernel-mode driver load auditing and monitor for tampering with fortips.sys on disk
Alert on Windows Error Reporting and BSOD telemetry referencing FortiClient components, as failed exploitation attempts frequently produce kernel faults
Baseline expected FortiClient IPSec session activity per user and investigate deviations from that baseline

How to Mitigate CVE-2025-47761

Immediate Actions Required

Upgrade FortiClientWindows 7.4.x to version 7.4.4 or later as directed by Fortinet advisory FG-IR-25-112
Upgrade FortiClientWindows 7.2.x to version 7.2.10 or later per the same advisory
Restrict interactive and remote local logon rights on endpoints running FortiClient to reduce the pool of potential attackers
Audit accounts with local logon rights on VPN endpoints and remove unnecessary access

Patch Information

Fortinet has released fixed versions of FortiClient for Windows. Refer to the vendor advisory FG-IR-25-112 for the complete list of remediated builds and upgrade instructions. Apply the vendor patch as the primary mitigation.

Workarounds

Where patching cannot be performed immediately, disable the FortiClient VPN IPSec feature since exploitation requires an active IPSec tunnel
Enforce least-privilege configurations and application allowlisting to prevent untrusted binaries from opening the fortips device object
Ensure Windows exploit mitigations, including Hypervisor-Protected Code Integrity (HVCI) and kernel Control Flow Guard, are enabled to raise the cost of kernel exploitation

bash

# Verify installed FortiClient version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClient\FA_UI" | Select-Object Version