HTTP Request Smuggling Vulnerability in Fortinet's FortiOS Products
CVE-2025-55018

5.2MEDIUM

Key Information:

Vendor

Fortinet
Status
FortiOS
Vendor
CVE Published:
10 February 2026

What is CVE-2025-55018?

This vulnerability in Fortinet's FortiOS products arises from an inconsistent interpretation of HTTP requests, known as HTTP request smuggling. An unauthenticated attacker could exploit this weakness by crafting specific HTTP headers to smuggle unlogged requests through firewall policies. This attack may result in serious security implications affecting network integrity.

Affected Version(s)

FortiOS 7.6.0

FortiOS 7.4.0 <= 7.4.9

FortiOS 7.2.0 <= 7.2.13

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-667

CVSS V3.1

Score:
5.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.