Fortinet · Multiple Products
CVE-2025-32756
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
What it is
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
CISA: Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: June 4, 2025
- Added to the CISA list
- May 14, 2025
- Published
- May 13, 2025
- Severity
- Critical 9.6 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 31% in the top 1.7% of all known vulnerabilities
- Weakness
- CWE-124
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jan 27, 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Critical 9.4 | 87% |
| Dec 16, 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Critical 9.1 | 68% |
| Oct 9, 2024 | Format String | Multiple Products | Critical 9.8 | 62% |
| Oct 11, 2022 | Authentication Bypass | Multiple Products | Critical 9.8 | >99.9% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.