CVE-2025-53379: Fortinet FortiAuthenticator Info Disclosure

CVE-2025-53379 Overview

CVE-2025-53379 is an out-of-bounds read vulnerability [CWE-125] affecting Fortinet FortiAuthenticator. The flaw exists in FortiAuthenticator 6.6.0 through 6.6.2 and all versions of the 6.5 branch. A remote, unauthenticated attacker can send a specially crafted request to read sensitive information from process memory. The vulnerability carries a CVSS 3.1 base score of 7.5, driven by network-based exploitation without authentication or user interaction. Only confidentiality is impacted; integrity and availability remain intact.

Critical Impact
Remote unauthenticated attackers can retrieve sensitive information from FortiAuthenticator memory, potentially exposing credentials, session data, or configuration details used across authentication workflows.

Affected Products

Fortinet FortiAuthenticator 6.6.0 through 6.6.2
Fortinet FortiAuthenticator 6.5 (all versions)
Fortinet FortiAuthenticator identity and access management appliances

Discovery Timeline

2026-07-14 - CVE-2025-53379 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2025-53379

Vulnerability Analysis

CVE-2025-53379 is an out-of-bounds read [CWE-125] in FortiAuthenticator, Fortinet's centralized authentication, authorization, and accounting appliance. The product handles RADIUS, LDAP, SAML, and two-factor authentication for enterprise environments, which makes any memory disclosure directly relevant to identity security. An attacker sending a specially crafted request causes the service to read memory outside the intended buffer boundary. The returned data can include adjacent process memory, potentially containing authentication artifacts, tokens, or configuration values. Exploitation requires no credentials and no user interaction, and the request traverses the network path exposed by the appliance's management or authentication services. The EPSS score is 0.385% with a percentile of 30.86, but exposure risk is elevated because FortiAuthenticator is often reachable from partner networks or dedicated management segments.

Root Cause

The root cause is missing or insufficient bounds validation when parsing attacker-controlled input in an affected request handler. The code path reads beyond the allocated buffer and returns the resulting bytes in the response or error output, allowing information disclosure without corrupting state.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted HTTP or protocol-specific request to the FortiAuthenticator service and parses the response for leaked memory contents. Repeated requests can be issued to harvest additional memory regions over time.

No public proof-of-concept code is available for CVE-2025-53379. Refer to the Fortinet Security Advisory FG-IR-26-146 for vendor technical details.

Detection Methods for CVE-2025-53379

Indicators of Compromise

Unusual volumes of malformed or oversized requests to FortiAuthenticator management and authentication endpoints from a single source.
Repeated requests returning inconsistent response sizes, indicative of memory-scraping attempts.
Access to FortiAuthenticator services from IP addresses outside expected administrative or federation networks.

Detection Strategies

Enable verbose logging on FortiAuthenticator and forward events to a centralized log platform for correlation.
Deploy IDS/IPS signatures that flag protocol anomalies against FortiAuthenticator service ports.
Correlate authentication service access logs with network flow data to identify reconnaissance patterns.

Monitoring Recommendations

Monitor FortiAuthenticator process memory and CPU for anomalous patterns tied to repeated crafted requests.
Alert on unauthenticated requests to sensitive endpoints originating from non-trusted network zones.
Track downstream authentication events for signs of session or credential reuse following any suspected leak.

How to Mitigate CVE-2025-53379

Immediate Actions Required

Identify all FortiAuthenticator instances running 6.5.x or 6.6.0 through 6.6.2 and prioritize them for patching.
Restrict network access to FortiAuthenticator management and authentication interfaces to trusted administrative segments only.
Rotate secrets and API tokens stored on affected appliances if compromise is suspected.

Patch Information

Fortinet has published guidance and fixed versions in advisory FG-IR-26-146. Upgrade to the fixed release listed in the advisory. Verify the running build after upgrade using get system status on the FortiAuthenticator CLI.

Workarounds

Place FortiAuthenticator behind a reverse proxy or WAF that rejects malformed or oversized requests to affected endpoints.
Apply strict source IP allow-lists to administrative and federation service interfaces until patching is complete.
Disable any non-essential external-facing services on the appliance to reduce attack surface.

bash

# Example: restrict FortiAuthenticator admin access to trusted subnets
config system interface
  edit port1
    set allowaccess https ssh
    set trusthost1 10.0.0.0 255.255.255.0
  next
end