CVE-2025-32756: 
Fortimail vulnerability analysis and mitigation

A critical severity stack-based buffer overflow vulnerability (CVE-2025-32756) was discovered in multiple Fortinet products on May 13, 2025. The vulnerability affects FortiVoice, FortiCamera, FortiMail, FortiNDR, and FortiRecorder across various versions. This vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) and has been confirmed to be actively exploited in the wild (Fortinet Advisory, Rapid7 Blog).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) in the administrative API that allows remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests with malformed hash cookies. The vulnerability specifically involves the APSCOOKIE parameter in the admin.fe endpoint, where improper validation of the AuthHash field can lead to a buffer overflow condition (Horizon3 Blog).

The vulnerability enables unauthenticated remote attackers to achieve remote code execution (RCE) on affected systems. When successfully exploited, attackers can execute arbitrary code or commands, potentially leading to complete system compromise. The severity is heightened by the fact that no authentication is required to exploit the vulnerability (Fortinet Advisory, Arctic Wolf).

Fortinet has released patches for supported versions and provided migration guidance for unsupported versions. For customers unable to immediately update, Fortinet recommends disabling the HTTP/HTTPS administrative interface as a temporary workaround. Specific version upgrades have been detailed for each affected product, such as FortiVoice 7.2.0 to 7.2.1, FortiMail 7.6.0-7.6.2 to 7.6.3, and similar updates for other affected products (Fortinet Advisory).