CVE-2025-59921: Fortinet FortiADC Information Disclosure

CVE-2025-59921 Overview

CVE-2025-59921 is an information disclosure vulnerability in Fortinet FortiADC application delivery controllers. The flaw, classified as Exposure of Sensitive Information to an Unauthorized Actor [CWE-200], allows an authenticated attacker to obtain sensitive data through crafted HTTP or HTTPS requests. Fortinet tracks this issue under advisory FG-IR-23-434.

The vulnerability affects multiple FortiADC release branches, including current and legacy versions. Exploitation requires valid authentication credentials but does not require user interaction.

Critical Impact
An authenticated attacker with low privileges can retrieve sensitive configuration or operational data from FortiADC devices via crafted HTTP/HTTPS requests over the network.

Affected Products

Fortinet FortiADC 7.4.0
Fortinet FortiADC 7.2.3 and below, 7.1.4 and below
Fortinet FortiADC 7.0 (all versions) and 6.2 (all versions)

Discovery Timeline

2025-10-14 - CVE-2025-59921 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59921

Vulnerability Analysis

CVE-2025-59921 is an information disclosure flaw in the FortiADC management interface. FortiADC is Fortinet's Application Delivery Controller (ADC) platform, which handles load balancing, SSL offloading, and web application protection.

An authenticated attacker can issue crafted HTTP or HTTPS requests against the appliance to retrieve data that should not be accessible to their role. The exposed data can include configuration values, internal state, or other sensitive material handled by the appliance. Because FortiADC frequently sits in front of business-critical applications, disclosed data may accelerate follow-on attacks against downstream services.

Root Cause

The underlying weakness maps to [CWE-200]: the application returns information to actors who are not explicitly authorized to receive it. Insufficient authorization or output filtering in one or more HTTP(S) handlers allows a low-privileged authenticated session to reach data intended for higher-privileged roles.

Attack Vector

Exploitation is remote and requires network access to the FortiADC management interface plus valid credentials at a low privilege level. No user interaction is required. The attacker submits crafted HTTP or HTTPS requests to the affected endpoints, and the appliance returns sensitive information in the response.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Fortinet PSIRT Advisory FG-IR-23-434 for vendor technical details.

Detection Methods for CVE-2025-59921

Indicators of Compromise

Unexpected authenticated HTTP or HTTPS requests to FortiADC management endpoints from accounts that normally do not perform administrative activity.
Anomalous volumes of GET requests or unusually large response payloads returned to low-privileged administrative users.
Access to management URIs from source IPs outside approved administrative networks.

Detection Strategies

Enable and forward FortiADC administrative audit logs to a central SIEM for correlation against user-role baselines.
Alert on API or GUI requests where the authenticated user's role does not match the sensitivity of the accessed resource.
Track authentication events tied to low-privileged administrative accounts and flag deviations in request patterns or accessed endpoints.

Monitoring Recommendations

Ingest FortiADC syslog and event logs into a centralized data lake for long-retention analysis and threat hunting.
Monitor for successful logins from unexpected geographic locations or during off-hours to management interfaces.
Establish baselines for normal administrative API usage and alert on statistical deviations, particularly response size spikes.

How to Mitigate CVE-2025-59921

Immediate Actions Required

Restrict FortiADC management interface access to a dedicated, isolated administrative network using trusted host allow-lists.
Audit all local and remote administrative accounts on affected FortiADC devices and disable unused or stale credentials.
Rotate credentials and API tokens that may have been exposed through the management interface.
Review recent HTTP and HTTPS access logs on affected appliances for anomalous authenticated requests.

Patch Information

Fortinet has published guidance and fixed builds through PSIRT advisory FG-IR-23-434. Administrators should consult the Fortinet PSIRT Advisory FG-IR-23-434 for the recommended upgrade paths for FortiADC 7.4, 7.2, 7.1, 7.0, and 6.2 release branches, and upgrade to a version identified as not affected.

Workarounds

Limit management access to specific source IPs using FortiADC trusthost settings on administrator profiles.
Enforce least-privilege administrative roles so that operational accounts cannot reach sensitive configuration endpoints.
Require multi-factor authentication for all administrative logins to reduce the value of stolen or guessed credentials.
Place the management interface behind a VPN or bastion host rather than exposing it to broader internal or external networks.

bash

# Configuration example: restrict admin access to trusted hosts
config system admin
  edit "admin"
    set trusthost1 10.0.0.0 255.255.255.0
    set trusthost2 192.168.10.5 255.255.255.255
  next
end