SB2025101568 - Race condition in FortiAnalyzer
Published: October 15, 2025
Security Bulletin ID
SB2025101568
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition (CVE-ID: CVE-2025-54973)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to concurrent execution using shared resource with improper synchronization ('race condition') in FortiCloud SSO SAML authentication. An attacker can attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.
Remediation
Install update from vendor's website.