CyberCVE

CVE-2025-46774

An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to

Severity
Medium 6.8
CVSS 3.1
Adjacent, local or physical access what this means
Exploited
Not listed
EPSS
0.001
0.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet

Description

An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.

Weakness: CWE-347

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiClientMac

Credit

Fortinet is pleased to thank Mykola Grymalyuk from RIPEDA Consulting for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiClientMac version 7.4.4 or above Upgrade to FortiClientMac version 7.2.10 or above

References

Something wrong here?