All vulnerabilities
CVE-2025-32756

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Fortinet Multiple ProductsNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationExploited in the wildAdded to KEV 14 May 2025CISA KEV
Exploit odds (EPSS)30.9%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline4 Jun 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 13 May 2025, 14:46 UTCPublishedCVE List
  2. 14 May 2025Added to CISA KEVCISA KEV

Description

Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.

Text from CVE List

Affected versions 23

  • FortiNDRaffected: 7.6.0CVE List
  • FortiNDRaffected: 7.4.0 through 7.4.7CVE List
  • FortiNDRaffected: 7.2.0 through 7.2.4CVE List
  • FortiNDRaffected: 7.1.0 through 7.1.1CVE List
  • FortiNDRaffected: 7.0.0 through 7.0.6CVE List
  • FortiNDRaffected: 1.5.0 through 1.5.3CVE List
  • FortiNDRaffected: 1.4.0CVE List
  • FortiNDRaffected: 1.3.0 through 1.3.1CVE List
  • FortiNDRaffected: 1.2.0CVE List
  • FortiNDRaffected: 1.1.0CVE List
  • FortiCameraaffected: 2.1.0 through 2.1.3CVE List
  • FortiCameraaffected: 2.0.0CVE List
  • FortiCameraaffected: 1.1.0 through 1.1.5CVE List
  • FortiRecorderaffected: 7.2.0 through 7.2.3CVE List
  • FortiRecorderaffected: 7.0.0 through 7.0.5CVE List
  • FortiRecorderaffected: 6.4.0 through 6.4.5CVE List
  • FortiVoiceaffected: 7.2.0CVE List
  • FortiVoiceaffected: 7.0.0 through 7.0.6CVE List
  • FortiVoiceaffected: 6.4.0 through 6.4.10CVE List
  • FortiMailaffected: 7.6.0 through 7.6.2CVE List
  • FortiMailaffected: 7.4.0 through 7.4.4CVE List
  • FortiMailaffected: 7.2.0 through 7.2.7CVE List
  • FortiMailaffected: 7.0.0 through 7.0.8CVE List

References 3