CVE-2025-32756
Published: May 14, 2025
Official Description
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
CISA KEV Advisory
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This CVE describes a stack-based overflow vulnerability affecting Fortinet FortiFone, FortiVoice, FortiNDR, and FortiMail products. A remote unauthenticated attacker could exploit this flaw via crafted HTTP requests to execute arbitrary code or commands. The high EPSS score of 0.33121 and its inclusion in CISA's KEV catalog indicate a significant and confirmed exploitation risk.
This vulnerability is being actively exploited in the wild and is listed in CISA's KEV catalog, confirming its active use by threat actors. The flaw is remotely exploitable by unauthenticated attackers via crafted HTTP requests.
Administrators should apply available patches or firmware updates for affected Fortinet FortiFone, FortiVoice, FortiNDR, and FortiMail products immediately. Implementing robust web application firewall (WAF) rules may also provide some protection.
Technical Analysis
CVE-2025-32756 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2025-32756 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-32756 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1