Skip to main content
HIGH

CVE-2025-52970

CVSS v3

8.1

HIGH

EPSS Score

10.1 %

exploit probability, as of 2026-10-04

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Technical details

Published
2025-08-12

Frequently asked questions

What is CVE-2025-52970?

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Is CVE-2025-52970 actively exploited?

Active exploitation of CVE-2025-52970 has not been confirmed. Its EPSS score was 10.1% on 2026-10-04, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-52970?

CVE-2025-52970 has a CVSS v3 base score of 8.1 (HIGH severity).

Is CVE-2025-52970 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database