---
title: "Fortinet TACACS+ Vulnerability Alert – CVE-2025-22252: What You Need to Know"
description: At Logically, maintaining the security of your network is our mission. We want to bring to your attention a recently disclosed Fortinet vulnerability identified as CVE-2025-22252. This Fortinet CVE highlights a security issue involving TACACS+ authentication on specific Fortinet devices, including FortiGate firewalls and FortiProxy appliances. Released on May 13, 2025, this vulnerability underscores the need for swift and strategic remediation.
---

[Security Bulletin ](https://www.logically.com/security-bulletin)

# [Fortinet TACACS+ Vulnerability Alert – CVE-2025-22252: What You Need to Know](https://www.logically.com/security-bulletin/fortinet-tacacs-vulnerability-alert-cve-2025-22252-what-you-need-to-know)

 Written by [Michael Webber](https://www.logically.com/security-bulletin/author/michael-webber) | May 15, 2025 9:53:11 PM

At Logically, maintaining the security of your network is our mission.

We want to bring to your attention a recently disclosed Fortinet vulnerability identified as CVE-2025-22252 on May 13, 2025. This Fortinet CVE highlights a security issue involving TACACS+ authentication on specific Fortinet devices, including FortiGate firewalls and FortiProxy appliances.

Understanding CVE-2025-22252

This is an authentication bypass vulnerability affecting Fortinet products that utilize the TACACS+ protocol with ASCII authentication. TACACS+ is a centralized authentication method developed by Cisco, commonly used for managing administrative access and permissions across network devices.

Key Facts:

- **CVE ID:** CVE-2025-22252
- **Impacted Products: **FortiGate firewalls and FortiProxy appliances using TACACS+ with ASCII
- **Exploitability:** Requires attacker to know an existing admin account for exploitation
- **Scope of Impact:** Limited; most customer environments do not use TACACS+ in this configuration

 Full advisory: [Fortinet PSIRT FG-IR-24-472](https://www.fortiguard.com/psirt/FG-IR-24-472)

Who Is Affected?

Only customers who have implemented TACACS+ authentication with ASCII on their Fortinet devices are affected. If your organization does not use this authentication method, this vulnerability is non-exploitable. Furthermore, devices running firmware versions 7.2.x and below are not impacted.

Recommended Firmware Upgrades

Fortinet has released patched firmware to address the vulnerability. At Logically, we recommend upgrading to the patched version as soon as possible.

Note: FortiOS Versions 7.4.4 through 7.4.6 are affected. Any devices operating on these firmware versions should be upgraded to 7.4.7. FortiOS Versions in the 7.2.x family are not affected.

If you cannot upgrade immediately, Fortinet has provided workaround instructions to temporarily mitigate the risk.

What Logically Is Doing

Our team is actively reviewing customer environments and has begun creating tickets for all devices operating on an affected firmware. Our goals are to:

- **Identify **affected systems
- **Schedule **firmware updates and/or implement workarounds
- **Communicate **transparently and efficiently with impacted clients

If you are not a managed customer but need help applying a patch or verifying your vulnerability status, we offer assistance under billable support hours. Contact us directly at help@logically.com or call us at 866-946-9638 to get support or to discuss a transition to a managed security service.

Immediate Next Steps

If you're unsure whether your devices are vulnerable, take these steps:

1. Audit your authentication methods on FortiGate or FortiProxy devices.
2. Verify your firmware version and upgrade to the recommended release if applicable.
3. Contact Logically for support with patching, verification, or workaround implementation.

Conclusion

Staying current with firmware updates and security advisories is key to protecting your environment. While this TACACS+ vulnerability has not been actively exploited to date, taking preventive action now will safeguard your network from potential misuse.

At Logically, we remain committed to keeping your systems protected and your teams informed. To discuss how Logically can support your security strategy, or to address any concerns about this vulnerability, please do not hesitate to contact us. Your vigilance and partnership help us build stronger, safer networks—one update at a time.

[View full post](https://www.logically.com/security-bulletin/fortinet-tacacs-vulnerability-alert-cve-2025-22252-what-you-need-to-know)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Michael Webber"
  },
  "dateModified" : "2025-05-16T16:58:29.746Z",
  "datePublished" : "2025-05-15T21:53:11Z",
  "headline" : "Fortinet TACACS+ Vulnerability Alert – CVE-2025-22252: What You Need to Know",
  "image" : {
    "@type" : "ImageObject",
    "height" : 628,
    "url" : "https://4883612.fs1.hubspotusercontent-na1.net/hubfs/4883612/Trackforce_TrackTik_Blog_2023_Security_Technology_Trends_V1-1.webp",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.logically.com/security-bulletin/fortinet-tacacs-vulnerability-alert-cve-2025-22252-what-you-need-to-know",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Security Bulletin"
  }
}
```