This vulnerability (CVE-2025-54821) in Fortinet FortiPAM and FortiOS products arises from improper privilege management (CWE-269). Authenticated administrators can exploit this flaw by issuing crafted CLI commands to bypass the trusted host policy, potentially allowing actions beyond intended restrictions. The affected products include FortiPAM versions 1.0.0 through 1.6.0 and FortiOS versions 6.4 all versions, 7.0 all versions, 7.2 all versions, 7.4.0 through 7.4.11, and 7.6.0 through 7.6.3, as well as FortiSASE 25.2.91. The vulnerability has a low severity with a CVSS v3.1 base score of 1.8, reflecting a low impact on confidentiality and availability and limited impact on integrity. An official fix has been released by the vendor.

The vulnerability allows an authenticated administrator to bypass the trusted host policy, which could lead to unauthorized actions beyond intended privilege boundaries. The CVSS score of 1.8 indicates a low severity impact, with no confidentiality or availability impact and only limited integrity impact. There are no known exploits in the wild.

An official fix is available for this vulnerability. Users should apply the vendor-provided patches to affected FortiPAM and FortiOS versions to remediate the issue. Since the vulnerability requires authenticated administrator access, ensuring proper access controls and applying the official fix will mitigate the risk effectively.