SAML authentication failure after configuration change.

Wrong certificate for client certificate exchange in action deny explicit policy.

ZTNA web-portal authentication fails after configuration update.

When "https-replacement-message" is disabled and traffic is blocked, FortiProxy aborts HTTP CONNECT without returning any error code to the HTTP CONNECT request.

Under FTP Active mode, AntiVirus NAC-quarantine will ban server side IP.

Adding some regex entries to URL filter causes other urlflter tables to stop working properly.

Unicast HA with transparent VDOM fails to sync.

ZTNA webportal's response contains body with HEAD method.

With a wrong URL(but with huge body) in OIDC discovery field, the CPU usage will

reach 100% when HTTP verbose log is enabled in console.

HTTP2 large file download may get stuck and fail.

Policy test does not working on service set on app-service-type app-id

The FURL license seat does not control the inline CASB feature.

Failure in matching VIP in policy when multiple addresses are in the dstaddr list for transparent proxy.

WAD ssl_cert leak in ZTNA.

Memory usage increases unexpectedly during high load when processing WAD-related tasks.

WAD crashed at fts_crypto_kxp_pub_key_verify_done.

Download failure occurs when accessing https://7-zip.de for domain objects.githubusercontent.com.

In explicit proxy policy, if the outgoing interface type is pppoe, all traffic will be blocked when fast matching is enable.

In non-transparent mode, enabling DNS protection for HTTP/HTTPS traffic causes the traffic to hang.

Inline IPS raw scan can leak memory.

IPsec tunnel does not forward traffic for certain interface port configurations.

WCCP crash after enabling WCCP under interface in FortiProxy VM.

Expired server certificates are issued during deep inspection.

Authentication pop-up does not appear when accessing HTTPS websites through FortiProxy with Explicit Proxy when authentication rules, webproxy-forward-server, and certificate-inspection are configured in policy.

After override enabled under endpoint-control.settings, traffic still matches the policies which use EMS tags under global VDOM.

"utmref" and "utmaction" fields are missing in forward traffic log and http-transaction

traffic log for long-tcp sessions.

SSH policy display issues in both GUI and CLI.

The FortiProxy is shut down unexpectedly when Active Directory is used.

Unexpected power off on FPX-400G.

detect-https-in-http-request no longer works.

Intermittent 504 errors occur when an IPv6 HTTP request followed by an IPv4 request in the same pipeline goes through explicit proxy with outgoing-ip.

SOCKS policy match user/group info is not assigned to session context.

Login again from the same IP with a previous unfinished TFA form login causes crash.

No PSU monitoring for FPX-400E.

Internal resources are inaccessible via IP or FQDN when using agentless ZTNA Access proxy-portal with apptype web on FortiProxy.

Crash during krb fallback traffic.

Creating a new address object from GUI on the secondary device fails when it's done under policy edit.

Downstream nodes can not communicate with each other when root is unreachable in security fabric.

Cannot configure ssl-ssh-profile for explicit-web policy with action redirect.

Password-protected files sent from FortiProxy cannot be opened or scanned by FortiSandbox.

Traffic log for proxy traffic does not include explicit-web-proxy name.

DNS lookup does not work for IPv6.

Inconsistent behaviour with authenticated users when the XFF is in the HTTP header and IP-based authentication is enabled in authentication rule.

Crash when executing get hardware nic <interface name>.

(SSL) HTTPS handshake fails when https-replacement-message is disable and authentication is required in policy.

Inconsistent blocking behaviors of banned IPs for different policy types and protocols.

Bypass for oversize files does not work.

OIDC authentication timeout with session-based access in ZTNA.

Expired user seats are counted as valid in license sharing.

Application control cannot block QUIC when proxy-inline-ips is enabled in the policy.

SOCKS request which matches any explicit-web-connect policy skips matching of explicit-web policies.

Duplicate log_id in WAD traffic logs when the forward server is down.

LDAP group queries do not work.

Inaccurate seat calculation for FNBI and FCAS license types during license sharing.

License sharing crash issue.

When MFA method is used for administrator users and OTP length is set to 8 on FortiToken, FortiProxy will not log the user in with an error "Authentication failure" even if the OTP is correct.

When using cookie-based authentication, auth_method shows "NULL" instead of "Cookie".

Incorrect and misleading logs for files detected as malware by FortiSandbox.

Webfilter service is not enabled when deny policy configured with url-category.

Upper case domain name triggered domain-fronting block on http1.1

External resource HTTP password cannot be blank when username is set.

Increase external resource password length to 512 from 128.

Count file not generated for threat feed external resource.

Incorrect URL is displayed after form authentication.

Authentication is not triggered for deny and redirect policy.

Log display issue when inline IPS is enabled.

CSF member does not update upstream path when HA AP switches from active to standby.

Improve ICAP connection pool counting to count overall connections from multiple workers.

For parameterized signatures, inline IPS does not include parameter value in the msg field of utm app log.

ICAP response ISTag header content should be quoted-string.

ZTNA web portal with dynamic ldap attribute bookmark does not work when the authentication method is form-based.

CVE-2025-59718 and CVE-2025-59719

CVE-2025-25255

CVE-2025-54821