External risk intelligence

Fortinet FortiPAM and FortiSwitchManager Weak Authentication Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-49201

FortiPAM is a Privileged Access Management solution often deployed as an internet-facing management portal. Similarly, FortiSwitchManager serves as a centralized management interface. These products are typically exposed or reachable within administrative segments to facilitate remote management, making them likely to be internet-reachable.

Fortinet Fortipam

1.0.0 to before 1.4.31.5.07.2.0 to before 7.2.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain Fortinet products, specifically FortiPAM and FortiSwitchManager. This issue, arising from weak authentication, could allow an unauthorized attacker to execute malicious code or commands remotely. Given the nature of these management tools, understanding their exposure and relevance within our environment is the primary concern.

Weak authentication allows remote code execution.
Critical management tools are potentially affected.
Confirm product relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HTTP requests over the network. This could potentially allow them to execute arbitrary code or commands on the affected systems.

No authentication required.
Specially crafted HTTP requests.
Unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

A weak authentication vulnerability in Fortinet FortiPAM and FortiSwitchManager could allow an unauthorized attacker to execute arbitrary code or commands. This could occur when specially crafted HTTP requests are sent to the affected systems, potentially leading to a compromise of the management interfaces.

Management interfaces and their configurations.
Specially crafted HTTP requests.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability affects Fortinet FortiPAM and FortiSwitchManager, suggesting that platform or infrastructure teams managing these specific Fortinet products are likely responsible for addressing this issue. The first practical step involves identifying all deployed instances of these products, determining their exposure and business criticality, and then confirming the accountable owner for each instance to prioritize and plan remediation.

Platform or Infrastructure teams own remediation.
Verify product exposure and criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fortinet FortiPAM and FortiSwitchManager?

FortiPAM is a Privileged Access Management solution designed to secure and control access to critical administrative accounts. FortiSwitchManager serves as a centralized interface for managing network switches. Both are infrastructure management tools used by IT teams to oversee sensitive parts of a network, making them central to an organization's secure operations and administrative control.

What does weak authentication mean for CVE-2025-49201?

This vulnerability is classified as CWE-1390, which refers to weaknesses in how a system verifies user identity. In the context of CVE-2025-49201, this flaw allows an unauthenticated user to bypass standard login requirements. Because the authentication is insufficient, the system fails to verify the requestor's legitimacy, enabling the unauthorized execution of commands.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends specially crafted HTTP requests to the affected management interfaces. Because the system does not properly enforce authentication, these malicious requests are processed as legitimate commands. Importantly, the vulnerability does not require the attacker to have valid credentials, as the flaw resides in the initial handling of the incoming network communication.

Is my organization at risk from CVE-2025-49201?

If you run these products, your risk depends on network visibility. Halo Surface Signal notes that FortiPAM and FortiSwitchManager are often deployed as management portals. Because these interfaces are frequently exposed to facilitate remote administration, they are considered likely to be internet-reachable. Any instance accessible from the internet carries a significantly higher risk of being targeted by unauthorized remote users.

What should I do if I run affected Fortinet software?

First, conduct an inventory of all instances of FortiPAM and FortiSwitchManager within your environment to understand your total footprint. Once identified, evaluate the network exposure and business criticality of each instance. Coordinate with the infrastructure teams responsible for these systems to prioritize them for remediation, ensuring you have the necessary information to plan updates before proceeding.

References

fortiguard.fortinet.com/psirt/FG-IR-25-010

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.