CVE-2025-64157CWE-134

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11…

Medium · published February 10, 2026

CVSS v3.1
6.7
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.01516 · 74.3th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2026-02-10T15:39Z
EPSS history
Timeline
  • 10 FEB 15:39Z
    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11…
    cvelistv5