Exposed IOCTL with Insufficient Access Control in Fortinet FortiClient for Windows - CVE-2025-47761
Published: November 18, 2025
Vulnerability identifier: #VU118597
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-47761
CWE-ID: CWE-782
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to execute arbitrary code.
The vulnerability exists due to exposed ioctl with insufficient access control via FortIPS driver. An authenticated local user can execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.
Affected software
Fortinet FortiClient for Windows
How to mitigate CVE-2025-47761
Install update from vendor's website.
Fortinet FortiClient for Windows - addressed in versions 7.2.10, 7.4.4