CVE-2025-32756: 
Fortimail vulnerability analysis and mitigation

CVE-2025-32756 is a critical stack-based buffer overflow vulnerability affecting multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. The vulnerability was discovered on May 13, 2025, by Fortinet's Product Security Team and carries a CVSS score of 9.6. This security flaw affects multiple versions of the affected products, including FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and 6.4.0 through 6.4.10 (Fortinet Advisory).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) that allows remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests with malformed hash cookies. The vulnerability has received a Critical severity rating with a CVSS v3.1 score of 9.8, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD, Fortinet Advisory).

The vulnerability enables remote code execution capabilities, allowing attackers to execute arbitrary code or commands on affected systems. When exploited, attackers can perform various malicious activities including network scanning, system log erasure, and credential theft through fcgi debugging. The impact is particularly severe as it affects multiple critical Fortinet products and requires no authentication for exploitation (Hacker News).

Fortinet has released patches for all affected products and versions. Users are strongly advised to upgrade to the latest fixed versions: FortiVoice 7.2.1 or above, FortiMail 7.6.3 or above, FortiNDR 7.6.1 or above, and FortiRecorder 7.2.4 or above. For systems that cannot be immediately patched, Fortinet recommends disabling the HTTP/HTTPS administrative interface as a temporary workaround. Users of older versions of FortiCamera 2.0, 1.1, and various FortiNDR versions are advised to migrate to a fixed release (Fortinet Advisory).

The security community has responded with heightened concern due to the critical nature of the vulnerability and its active exploitation in the wild. The vulnerability's addition to CISA's KEV catalog underscores its severity and the urgent need for remediation. Security researchers have emphasized the importance of immediate patching given Fortinet products' history of being targeted by threat actors (Rapid7).