Fortinet flaws enable code execution across 30+ products
Multiple vulnerabilities in Fortinet products allow remote code execution, with CVE-2025-32756 actively exploited in FortiVoice deployments.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 16 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-32756 as exploited in the wild.
Fortinet has disclosed multiple vulnerabilities across more than 30 products, including FortiOS, FortiManager, FortiAnalyzer, FortiVoice, FortiMail, and FortiWeb. The most severe vulnerability, CVE-2025-32756, is a stack-based buffer overflow affecting FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This flaw allows remote unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests. Fortinet has confirmed active exploitation of CVE-2025-32756 against FortiVoice systems in the wild.
Another critical vulnerability, CVE-2025-22252, affects FortiOS, FortiProxy, and FortiSwitchManager when TACACS+ authentication is configured with ASCII mode. This missing authentication flaw enables attackers with knowledge of an existing admin account to bypass authentication and access the device with full administrative privileges. Additional vulnerabilities include buffer overflows, integer overflows, privilege escalation issues, and command injection flaws in FortiManager and FortiAnalyzer.
The vulnerabilities affect products running versions 6.0 through 7.6 across multiple product lines. Organizations using Fortinet infrastructure should immediately apply available patches, particularly for internet-facing FortiVoice and FortiOS installations. The active exploitation of CVE-2025-32756 indicates threat actors are already targeting these flaws, making immediate remediation critical for affected systems.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Fortinet Web-Facing Service (Possible CVE-2025-32756 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned as a child of a Fortinet HTTP/HTTPS management daemon, consistent with remote code execution via crafted HTTP requests against FortiVoice/FortiMail/FortiNDR/FortiRecorder/FortiCamera. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Fortinet Web Daemon
id: 49c44985-9f3b-5282-b158-8688f2fbc83b
status: experimental
description: 'Detects execution of a command interpreter or shell utility as a child
process of a Fortinet management/web-facing daemon (e.g. httpsd, fcgi, cmdb-related
processes). This pattern is consistent with exploitation of stack-based buffer overflow
flaws such as CVE-2025-32756 that allow unauthenticated remote code execution via
crafted HTTP requests.
'
references:
- https://www.fortiguard.com/psirt/FG-IR-25-254
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- httpsd
- httpd
- fcgi
- cmdb
- wad
- sslvpnd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /wget
- /curl
condition: selection_parent and selection_child
falsepositives:
- Legitimate Fortinet internal helper scripts invoked by management daemons during
firmware updates or diagnostics
- Administrative CLI scripts executed via scheduled maintenance tasks
level: high
tags:
- attack.t1190
- attack.t1059
- cve.2025-32756
author: Vorant
Outbound Network Connection Initiated by Fortinet Management Daemon (Possible Post-Exploitation Callback)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an outbound network connection initiated by a Fortinet web/management daemon process shortly after handling an HTTP request, which may indicate a reverse shell or staging connection following successful exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection from Fortinet Web-Facing Daemon Process
id: d395cf6c-a062-586b-b63d-21c61e558f1f
status: experimental
description: 'Detects network connections originating from processes associated with
Fortinet HTTP/management daemons (httpsd, wad, sslvpnd, fcgi) toward external hosts.
This behaviour can indicate post-exploitation callback or data exfiltration following
remote code execution via vulnerabilities such as CVE-2025-32756.
'
references:
- https://www.fortiguard.com/psirt/FG-IR-25-254
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- httpsd
- wad
- sslvpnd
- fcgi
Initiated: true
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate license validation or update checks made by FortiOS/FortiVoice daemons
to Fortinet cloud services
- Internal management traffic to FortiManager/FortiAnalyzer on private network ranges
level: medium
tags:
- attack.t1190
- attack.t1059
- cve.2025-32756
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-049
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs