CVE-2025-53950
CVE-2025-53950 is a medium-severity vulnerability in Fortinet Fortidlp Agent with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-359.
Key facts
- Severity: Medium (CVSS 3.x base score 5.5)
- EPSS exploit prediction: 0% (6th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-34762
- Weakness: CWE-359
- Affected product: Fortinet Fortidlp Agent
- Published:
- Last modified:
Description
An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
Frequently asked questions
- What is CVE-2025-53950?
- An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
- How severe is CVE-2025-53950?
- CVE-2025-53950 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2025-53950 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-53950?
- CVE-2025-53950 affects Fortinet Fortidlp Agent. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-53950?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-53950 have an EU (EUVD) identifier?
- Yes. CVE-2025-53950 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34762.
- When was CVE-2025-53950 published?
- CVE-2025-53950 was published on 2025-10-16 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:fortinet:fortidlp_agent:*:*:*:*:*:*:*:*
More vulnerabilities in Fortinet Fortidlp Agent
- CVE-2025-54658 — High (CVSS 7.8): An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet…
- CVE-2025-53951 — Medium (CVSS 5.3): An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet…
- CVE-2025-46752 — Medium (CVSS 4.4): A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5…
All CVEs affecting Fortinet Fortidlp Agent →
Other CWE-359 vulnerabilities
- CVE-2022-0482 — Critical (CVSS 9.1): Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments…
- CVE-2022-2921 — High (CVSS 8.8): Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to…
- CVE-2025-53625 — High (CVSS 8.7): The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with…
- CVE-2025-13008 — High (CVSS 8.6): An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and…
- CVE-2023-36052 — High (CVSS 8.6): Azure CLI REST Command Information Disclosure Vulnerability
- CVE-2024-26192 — High (CVSS 8.2): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability