# Fortinet flaws enable code execution across 30+ products

Published: 2026-06-09 · Severity: critical · Sectors: government-national, financial-services, healthcare, education, telecommunications, infrastructure
Canonical: https://vorant.io/reports/874209f2-05f4-4031-9fdd-a47882e04d46/fortinet-flaws-enable-code-execution-across-30-products

> Multiple vulnerabilities in Fortinet products allow remote code execution, with CVE-2025-32756 actively exploited in FortiVoice deployments.

Fortinet has disclosed multiple vulnerabilities across more than 30 products, including FortiOS, FortiManager, FortiAnalyzer, FortiVoice, FortiMail, and FortiWeb. The most severe vulnerability, CVE-2025-32756, is a stack-based buffer overflow affecting FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This flaw allows remote unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests. Fortinet has confirmed active exploitation of CVE-2025-32756 against FortiVoice systems in the wild.

Another critical vulnerability, CVE-2025-22252, affects FortiOS, FortiProxy, and FortiSwitchManager when TACACS+ authentication is configured with ASCII mode. This missing authentication flaw enables attackers with knowledge of an existing admin account to bypass authentication and access the device with full administrative privileges. Additional vulnerabilities include buffer overflows, integer overflows, privilege escalation issues, and command injection flaws in FortiManager and FortiAnalyzer.

The vulnerabilities affect products running versions 6.0 through 7.6 across multiple product lines. Organizations using Fortinet infrastructure should immediately apply available patches, particularly for internet-facing FortiVoice and FortiOS installations. The active exploitation of CVE-2025-32756 indicates threat actors are already targeting these flaws, making immediate remediation critical for affected systems.

## Mentioned in this report

- Vulnerabilities: CVE-2006-5051, CVE-2008-4109, CVE-2023-42788, CVE-2023-48795 (templated), CVE-2024-35281, CVE-2024-54020, CVE-2024-6387 (poc), CVE-2025-22252, CVE-2025-22859, CVE-2025-24473, CVE-2025-25251, CVE-2025-26466, CVE-2025-32756 (KEV), CVE-2025-46777, CVE-2025-47294, CVE-2025-47295

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Fortinet Web-Facing Service (Possible CVE-2025-32756 Exploitation)

ATT&CK: T1190

Detects a shell or scripting interpreter spawned as a child of a Fortinet HTTP/HTTPS management daemon, consistent with remote code execution via crafted HTTP requests against FortiVoice/FortiMail/FortiNDR/FortiRecorder/FortiCamera. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Fortinet Web Daemon
id: 49c44985-9f3b-5282-b158-8688f2fbc83b
status: experimental
description: 'Detects execution of a command interpreter or shell utility as a child
  process of a Fortinet management/web-facing daemon (e.g. httpsd, fcgi, cmdb-related
  processes). This pattern is consistent with exploitation of stack-based buffer overflow
  flaws such as CVE-2025-32756 that allow unauthenticated remote code execution via
  crafted HTTP requests.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-25-254
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpsd
    - httpd
    - fcgi
    - cmdb
    - wad
    - sslvpnd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /wget
    - /curl
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Fortinet internal helper scripts invoked by management daemons during
  firmware updates or diagnostics
- Administrative CLI scripts executed via scheduled maintenance tasks
level: high
tags:
- attack.t1190
- attack.t1059
- cve.2025-32756
author: Vorant
```

### Outbound Network Connection Initiated by Fortinet Management Daemon (Possible Post-Exploitation Callback)

ATT&CK: T1059

Detects an outbound network connection initiated by a Fortinet web/management daemon process shortly after handling an HTTP request, which may indicate a reverse shell or staging connection following successful exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection from Fortinet Web-Facing Daemon Process
id: d395cf6c-a062-586b-b63d-21c61e558f1f
status: experimental
description: 'Detects network connections originating from processes associated with
  Fortinet HTTP/management daemons (httpsd, wad, sslvpnd, fcgi) toward external hosts.
  This behaviour can indicate post-exploitation callback or data exfiltration following
  remote code execution via vulnerabilities such as CVE-2025-32756.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-25-254
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
    - httpsd
    - wad
    - sslvpnd
    - fcgi
    Initiated: true
  filter:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter
falsepositives:
- Legitimate license validation or update checks made by FortiOS/FortiVoice daemons
  to Fortinet cloud services
- Internal management traffic to FortiManager/FortiAnalyzer on private network ranges
level: medium
tags:
- attack.t1190
- attack.t1059
- cve.2025-32756
author: Vorant
```

### TACACS+ ASCII Admin Authentication Bypass Pattern on FortiOS Devices

ATT&CK: T1068

Detects successful administrative authentication events on FortiOS/FortiProxy/FortiSwitchManager where TACACS+ ASCII authentication is used, consistent with exploitation of the missing-authentication flaw CVE-2025-22252 that allows full admin access with only a known username. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious TACACS+ ASCII Admin Auth Success on FortiOS
id: 17884703-187b-52b5-bd43-0b33eba75a0a
status: experimental
description: 'Detects successful administrator authentication events using TACACS+
  with ASCII authentication mode on FortiOS, FortiProxy, or FortiSwitchManager. CVE-2025-22252
  allows an attacker who knows a valid admin username to bypass authentication entirely
  under this configuration, gaining full administrative access without a valid password.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-25-153
logsource:
  category: authentication
  product: fortios
detection:
  selection:
    AuthMethod: tacacs+
    AuthMode: ascii
    Result: success
    Privilege: admin
  condition: selection
falsepositives:
- Legitimate administrator logins via approved TACACS+ ASCII configuration where this
  is an accepted organizational standard
level: medium
tags:
- attack.t1068
- attack.t1190
- cve.2025-22252
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-049

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/874209f2-05f4-4031-9fdd-a47882e04d46/fortinet-flaws-enable-code-execution-across-30-products.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup