CVE-2025-32756: Fortinet FortiMail, FortiNDR, FortiVoice, FortiRecorder, FortiCamera stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8 and confirmed exploitation in CISA KEV makes this an urgent patch-first issue.

What it is

A stack-based buffer overflow (CWE-121/CWE-787) in multiple Fortinet products is reachable by sending HTTP requests with a specially crafted hash cookie. It affects FortiCamera, FortiMail, FortiNDR, FortiRecorder and FortiVoice across many listed version ranges. Because it is network-reachable, unauthenticated and can lead to code execution, it is a serious edge-facing flaw.

Impact

A remote unauthenticated attacker can execute arbitrary code or commands on the affected appliance, giving full control of the device and a foothold into the network it protects.

Attack surface

Reached over the network via HTTP requests carrying a crafted hash cookie; the CVSS vector shows no privileges and no user interaction required. Any internet-exposed management or service interface of the listed products is in scope.

Exploitation

CVE-2025-32756 was added to CISA KEV on 2025-05-14 with a remediation due date of 2025-06-04, indicating known exploitation in the wild; EPSS 30-day probability is about 29.8 percent (98th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Fortinet vendor updates for each affected product line per FG-IR-25-254; patch internet-facing appliances first.
• If patching is not immediately possible, restrict HTTP access to affected interfaces to trusted management networks and disable or block external exposure.
• Follow CISA BOD 22-01 guidance for cloud services and the KEV required action, including discontinuing use where no mitigation exists.
• Audit exposed FortiMail, FortiNDR, FortiVoice, FortiRecorder and FortiCamera instances and remove any that cannot be patched or isolated.

Detection

• Inspect HTTP request logs for malformed or unusually long hash cookie values against Fortinet appliance interfaces.
• Monitor appliance processes for unexpected child processes, command execution or crashes consistent with buffer overflow exploitation.
• Alert on outbound connections from affected appliances to unfamiliar hosts, which may indicate post-exploitation activity.
• Track KEV status and vendor advisories for these products and verify patch state across the estate.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.