CVE-2025-32756

criticalKEV · exploitedEPSS 0.309 · 98 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 5 exploits · PoC

Likely / severe?

30.9% (98th) EPSS

CVSS 9.8 · critical

Is it mine?

89 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-05-14remediate by 2025-06-04

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-20

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:Csecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@fortinet.comexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-121USCWE-121US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (5)

Public proof-of-concept and weaponised exploit code.

alm6no5/CVE-2025-32756-POCalm6no5/CVE-2025-32756-POCPoC · poc_in_github
becrevex/CVE-2025-32756CVE-2025-32756: NSE Scanning for RCE in vulnerable FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera nodesPoC · poc_in_github
exfil0/CVE-2025-32756-POCDesigned for Demonstration of Deep Exploitation.PoC · poc_in_github
kn0x0x/CVE-2025-32756-POCProof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products.PoC · poc_in_github
shan0ar/cve-2025-32756shan0ar/cve-2025-32756PoC · poc_in_github

affected products (89)

Products and version ranges known to be affected.

Fortinet FortiMail <7.0.9all versionscert_bundDE
Fortinet FortiMail <7.2.8all versionscert_bundDE
Fortinet FortiMail <7.4.5all versionscert_bundDE
Fortinet FortiMail <7.6.3all versionscert_bundDE
Fortinet FortiRecorder <6.4.6all versionscert_bundDE
Fortinet FortiRecorder <7.0.6all versionscert_bundDE
Fortinet FortiRecorder <7.2.4all versionscert_bundDE
Fortinet FortiVoice <6.4.11all versionscert_bundDE
Fortinet FortiVoice <7.0.7all versionscert_bundDE
Fortinet FortiVoice <7.2.1all versionscert_bundDE
Fortinet FortiMail< 7.0.9cert_bundDE
Fortinet FortiMail< 7.2.8cert_bundDE
Fortinet FortiMail< 7.4.5cert_bundDE
Fortinet FortiMail< 7.6.3cert_bundDE
Fortinet FortiRecorder< 6.4.6cert_bundDE
Fortinet FortiRecorder< 7.0.6cert_bundDE
Fortinet FortiRecorder< 7.2.4cert_bundDE
Fortinet FortiVoice< 6.4.11cert_bundDE
Fortinet FortiVoice< 7.0.7cert_bundDE
Fortinet FortiVoice< 7.2.1cert_bundDE

showing 20 of 89

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-1027Fortinet FortiVoice, FortiMail und FortiRecorder: Schwachstelle ermöglicht CodeausführungDeutsch2025-05-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiVoice, Fortinet FortiRecorder und Fortinet FortiMail ausnutzen, um beliebigen Programmcode mit administrativen Rechten auszuführen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2025-05-13modified 2026-06-17

related (15,588)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2021-48020US	medium	—	—	—
CVE-2021-48018US	high	—	—	—
CVE-2020-37286US	medium	—	—	—
CVE-2026-113300US	—	—	—	—
CVE-2026-109576US	—	—	—	—

+15583 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan