CVE WatchOct 18, 2026

CVE-2025-46775

A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through

CVSS

5.5

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Nov 18, 2025 · Last modified: Oct 18, 2026 · CWE-1295

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-09-302026-10-27

Technical description

A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.

Official references

fortiguard.fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-25-259

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-288117.5 HIG

56.0%

——17Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.5d CVE-2025-129106.2 MED

4.2%

——1Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)22d CVE-2025-350313.3 LOW

3.5%

——1Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.20d