CVE-2025-32756

CRITICAL9.8

CISA KEV

Published 2025-05-13 · Updated 2026-06-17 · Source psirt@fortinet.com

Summary

CVE-2025-32756 is a critical-severity (CVSS 9.8) vulnerability in Fortinet Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on May 14, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 4, 2025. CISA does not currently list it as used in ransomware campaigns. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.

All 32 known-exploited Fortinet vulnerabilities →

Description

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121CWE-787

CISA Known-Exploited Vulnerability

Product: Fortinet — Multiple Products

Name: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Date added: 2025-05-14 · Due: 2025-06-04

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Fortinet vulnerabilities

Most recently added to CISA KEV

CVE-2025-61624
Multiple Products — Fortinet Multiple Products Path Traversal Vulnerability
added 2026-10-16
CVE-2026-104286
FortiMail — Fortinet FortiMail Path Traversal Vulnerability
added 2026-10-01
CVE-2025-25249
Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
added 2026-09-09
CVE-2025-68686
FortiOS — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
added 2026-07-27
CVE-2026-25089
FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability
added 2026-07-16
CVE-2026-39808
FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability
added 2026-07-16

View all →

Related CVEs

Same severity, most recent

CVE-2026-109469
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
2026-11-06 · score 10.0
CVE-2026-68935
Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can enable this field to bypass private and reserved-network destination restrictions. An upgrade migration also enables the override on pre-existing API connections. The per-connection setting takes precedence over CB_ALLOW_PRIVATE_NETWORK_CALLS , so disabling that instance option does not protect connections with the override enabled. Successful exploitation allows requests to internal HTTP services reachable from the Chartbrew server, potentially disclosing information or triggering unauthorized actions depending on the target service. Recognized cloud metadata endpoints remain separately blocked. This issue is fixed in version 5.2.3.
2026-11-06 · score 9.1
CVE-2026-59104
UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
2026-11-06 · score 9.8
CVE-2026-86044
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.
2026-11-06 · score 9.6
CVE-2026-85295
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.
2026-11-06 · score 9.8