CVE-2025-58412: Fortinet FortiADC XSS Vulnerability

CVE-2025-58412 Overview

CVE-2025-58412 is a reflected cross-site scripting (XSS) vulnerability affecting multiple versions of Fortinet FortiADC, the application delivery controller product line. The flaw stems from improper neutralization of script-related HTML tags in a web page [CWE-80]. An attacker can craft a malicious URL that, when visited by an authenticated user, executes unauthorized code or commands in the victim's browser session. Fortinet published the advisory as FG-IR-25-736.

Critical Impact
A remote unauthenticated attacker can execute arbitrary script in the browser of a FortiADC user through a crafted URL, potentially leading to session compromise or unauthorized administrative actions.

Affected Products

Fortinet FortiADC 8.0.0
Fortinet FortiADC 7.6.0 through 7.6.3
Fortinet FortiADC 7.4 (all versions) and 7.2 (all versions)

Discovery Timeline

2025-11-19 - CVE-2025-58412 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58412

Vulnerability Analysis

The vulnerability is a basic reflected XSS issue in the FortiADC web management interface. FortiADC fails to properly neutralize script-related HTML tags before reflecting user-supplied input back into a rendered web page. When the victim opens a crafted URL, the injected payload executes in the context of the FortiADC administrative session.

The attack requires user interaction, as noted by the UI:R component in the vector. The scope change indicator S:C means impact extends beyond the vulnerable component. Both confidentiality and integrity are affected at low levels because attacker-controlled script executes with the privileges of the authenticated session. EPSS currently rates the exploitation probability at 0.149%.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled parameters that are echoed into HTML responses by the FortiADC web interface. FortiADC accepts input containing script-related HTML tags, such as <script>, and returns them in the response body without proper sanitization. This maps directly to [CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)].

Attack Vector

Exploitation follows the standard reflected XSS pattern. The attacker constructs a URL to a vulnerable FortiADC endpoint with a parameter containing HTML tag payloads. The attacker delivers the URL through phishing, chat, or a link on an attacker-controlled site. When an authenticated FortiADC administrator clicks the link, the browser executes the injected script under the FortiADC origin. The script can read session tokens, issue authenticated API calls, or modify device configuration on behalf of the victim. Refer to the Fortinet Security Advisory FG-IR-25-736 for vendor-provided technical details.

Detection Methods for CVE-2025-58412

Indicators of Compromise

HTTP request logs on the FortiADC management interface containing script tag substrings such as %3Cscript%3E, onerror=, or javascript: in query parameters.
Referrer headers pointing to external, untrusted domains directly preceding administrative actions.
Unexpected configuration changes or new administrative sessions originating from an admin's IP shortly after clicking an external link.

Detection Strategies

Inspect web proxy and WAF logs for requests to FortiADC management URLs containing encoded HTML tag payloads.
Correlate email or messaging gateway telemetry for links that target FortiADC hostnames with long, obfuscated query strings.
Alert on browser-delivered payloads matching <script, <img src=x onerror, or <svg/onload patterns targeting FortiADC administrative paths.

Monitoring Recommendations

Enable and forward FortiADC administrative access logs to a centralized SIEM for parameter-level inspection.
Monitor administrative session activity for anomalous API calls that immediately follow browsing to external URLs.
Track FortiADC firmware versions across the fleet to identify hosts still running vulnerable 7.2, 7.4, 7.6.0–7.6.3, or 8.0.0 builds.

How to Mitigate CVE-2025-58412

Immediate Actions Required

Upgrade FortiADC to a fixed release as specified in Fortinet Security Advisory FG-IR-25-736.
Restrict access to the FortiADC management interface to trusted administrative networks and named jump hosts.
Require administrators to use dedicated browsers or workstations that do not access general web content or email.

Patch Information

Fortinet has published remediation guidance in advisory FG-IR-25-736. Administrators should consult the advisory for the specific fixed builds corresponding to the 7.2, 7.4, 7.6.x, and 8.0.x branches and upgrade accordingly. No public proof-of-concept exploit or CISA KEV listing exists for this issue at time of publication.

Workarounds

Disable or firewall off the FortiADC HTTPS management interface from untrusted networks until patching is complete.
Log administrators out of the FortiADC GUI when not actively performing management tasks to shrink the exploitation window.
Enforce strict Content Security Policy and browser isolation for administrators who must access the FortiADC web UI.

bash

# Example: restrict FortiADC administrative access to a trusted subnet
config system interface
  edit port1
    set allowaccess ping ssh https
    set trusthost 10.10.20.0 255.255.255.0
  next
end