DaystoPatch

FortinetExploited incident

Fortinet API stack overflow (FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera) exploited on FortiVoice

CVE-2025-32756Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 14 May 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-32756 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2025-05-13T14:46:44.208Z"

    Found by Fortinet 'based on threat activity'; its advisory, already stating exploitation on FortiVoice, is the first public signal.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:546099a9d74e1bec…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Fortinet advisory FG-IR-25-254ClaimedQuote verified13 May 2025

    Stack-based buffer overflow vulnerability in API

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-25-254 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bbd6ae3ccee379f8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-25-254 (Wayback snapshot 2025-05-14 07:01 UTC)CuratedQuote verified13 May 2025

    Fortinet has observed this to be exploited in the wild on FortiVoice.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1f10e96052c51813…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-32756ClaimedQuote verified13 May 2025, 14:46 UTC

    A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:546099a9d74e1bec…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 May 2025, 15:31 UTC

    https://cve.threatint.eu/CVE/CVE-2025-32756?utm_campaign=info&utm;_medium=rss&utm;_source=website

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-32756)ClaimedQuote verified14 May 2025

    Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-05-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-32756 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2025-05-13T14:46:44.208Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:546099a9d74e1bec…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-254CuratedQuote not checked yet13 May 2025

    2025-05-13: Initial publication

    Source
    Fortinet PSIRT FG-IR-25-254 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Fortinet PSIRT FG-IR-25-254 (Wayback snapshot 2025-05-14 07:01 UTC)CuratedQuote verified

    Disable HTTP/HTTPS administrative interface

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1f10e96052c51813…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet docs: FortiMail 7.6.3 release notes change logCuratedQuote not checked yet

    2025-04-15 Initial release of the FortiMail 7.6.3 Release Notes.

    R2: FortiMail 7.6.3, the FortiMail 7.6 fix in FG-IR-25-254, was released 2025-04-15, four weeks before the advisory. Per the audit, FortiRecorder 7.2.4 followed 2025-04-17 and FortiNDR 7.6.1 2025-04-24 (not re-fetched). The release date of the FortiVoice fixes (the exploited product) was not found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-254 (Wayback snapshot 2025-05-14 07:01 UTC)CuratedQuote verified13 May 2025

    Upgrade to 6.4.11 or above

    FortiVoice 6.4 fix; the snapshot taken the day after publication lists fixed releases for every product line with none marked 'upcoming'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1f10e96052c51813…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-25-254 (Wayback snapshot 2025-05-14 07:01 UTC)CuratedQuote verified

    Upgrade to 7.0.7 or above

    All listed branches of FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera had fixes at publication; branches marked 'Migrate to a fixed release' (e.g. FortiCamera 2.0/1.1, FortiNDR 1.1) are not counted.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1f10e96052c51813…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Fortinet API flaw exploited on FortiVoice; fixes listed May 13, 2025

Attackers exploited a stack overflow in the web API of several Fortinet appliances, seen on FortiVoice; a fixed FortiMail release shipped on 15 April 2025 and Fortinet's advisory with fixes for all products followed on 13 May 2025.

In plain words

Several Fortinet appliances, including the FortiVoice phone system and the FortiMail email gateway, had a critical flaw that attackers used on FortiVoice to take control and collect passwords. Fortinet published fixes for all affected products and a temporary workaround on 13 May 2025; some fixed versions, such as FortiMail 7.6.3, had shipped in April. If we use any of these products, we need to be on the fixed versions and check them for signs of tampering.

What happened and who is affected

What happened

On 13 May 2025 Fortinet disclosed CVE-2025-32756, a stack-based buffer overflow in the API of FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera that lets an unauthenticated attacker run code with crafted HTTP requests. Fortinet found it while investigating attacks on FortiVoice, where the attacker scanned networks, erased crash logs and enabled debugging to capture credentials. Fixed releases for all supported lines were listed in the advisory, along with a workaround; some, such as FortiMail 7.6.3 (15 April 2025), had already shipped.

Who is affected

FortiVoice 7.2.0, 7.0.0-7.0.6, 6.4.0-6.4.10; FortiMail 7.6.0-7.6.2, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.8; FortiRecorder 7.2.0-7.2.3, 7.0.0-7.0.5, 6.4.0-6.4.5; FortiCamera 2.1.0-2.1.3 (older lines must migrate); FortiNDR 7.6.0 and 7.4/7.2/7.0 before their fixed releases (see the advisory).

CVE-2025-32756. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2025-32756/

Affected products

  • FortiVoice
  • FortiMail
  • FortiNDR
  • FortiRecorder
  • FortiCamera
How we built this timeline

Zero-day: discovered by Fortinet from threat activity, exploitation on FortiVoice stated at publication, fixes at the same time. The first-day snapshot (20250514070108) has 23 product/branch rows with no 'upcoming' entries; the live page has 17 rows (some rows were consolidated or removed later).

Timeline: two entries, both 13 May 2025 (initial publication; format). KEV 14 May 2025.

Correction 23 Oct 2026 (audit 2, R2/R4): First fix is now 15 Apr 2025 (FortiMail 7.6.3 release notes), and exploited before a fix changes from true to false: a complete fixed release for one affected product line was public before the earliest public evidence of exploitation (the 13 May 2025 advisory). No source found dates the FortiVoice exploitation earlier (searched: FG-IR-25-254 IoCs and timeline, news coverage).

Caveat for the integrator (audit T4): FortiVoice, the product actually exploited, may not have had a fix before the attacks; R4 counts the first complete fix for any affected line.

Related

Fortinet report card