CVE-2025-32756

What it actually does

This is a stack-based buffer overflow in the HTTP handling path of multiple Fortinet products. A remote, unauthenticated attacker can send a specially crafted HTTP request containing a malicious hash cookie that overflows stack memory, allowing control of execution flow. Successful exploitation can result in arbitrary command or code execution in the context of the vulnerable web-facing service, potentially giving the attacker a foothold on the appliance and access to sensitive configuration, mail, voice, recording, camera, or network-detection data depending on the product.

Why it matters to the business

Because the vulnerability is remotely exploitable without authentication, rated critical, listed in CISA KEV, and observed as actively exploited in the wild, exposed Fortinet appliances should be treated as high-priority risk. Compromise could disrupt email security, voice services, recording/camera systems, or network detection capabilities, and could allow attackers to steal configurations, credentials, message data, call/recording metadata, or use the appliance as a pivot point into the wider network. CISA’s KEV remediation deadline was 2025-06-04, so any remaining unpatched exposure is materially overdue.

How an attack unfolds

An attacker first identifies an internet-facing or reachable Fortinet FortiCamera, FortiMail, FortiNDR, FortiRecorder, or FortiVoice appliance running an affected version. They then send crafted HTTP requests to the vulnerable web service with an intentionally malformed or oversized hash cookie. The vulnerable code copies cookie data into a fixed-size stack buffer without adequate bounds checking, corrupting stack memory. With a reliable exploit, the attacker redirects execution to attacker-controlled code or a command-execution chain. After gaining execution, the attacker may run reconnaissance commands, retrieve configuration and credential material, create persistence, upload tooling, tamper with logs, or use the appliance as a trusted internal pivot. Public reporting and KEV status indicate active exploitation, so exploitation attempts may include both opportunistic scanning and targeted attacks against exposed appliances.

How to fix it

Upgrade affected products to vendor-fixed releases immediately. The affected ranges include FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions; FortiMail 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, and 7.0.0 through 7.0.8; FortiNDR 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, and 7.0.0 through 7.0.6; FortiRecorder 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, and 6.4.0 through 6.4.5; and FortiVoice 7.2.0, 7.0.0 through 7.0.6, and 6.4.0 through 6.4.10. Where available, upgrade to FortiMail 7.6.3, 7.4.5, 7.2.8, 7.0.9 or later; FortiNDR 7.6.1, 7.4.8, 7.2.5, 7.0.7 or later; FortiRecorder 7.2.4, 7.0.6, 6.4.6 or later; FortiVoice 7.2.1, 7.0.7, 6.4.11 or later; and the vendor-fixed FortiCamera release for the deployed branch. If immediate upgrade is not possible, remove administrative and application web interfaces from direct internet exposure, restrict access to trusted management networks or VPN-only paths, apply web-layer filtering for malformed or oversized Cookie headers where feasible, and monitor closely for crashes, suspicious HTTP cookie activity, and unexpected child processes. Mitigation should be considered temporary; patching is the required fix.

How to confirm the fix worked

Confirm the running firmware/software version directly on each appliance and verify it is outside the vulnerable ranges or at/above the vendor-fixed release for its product branch. Validate that administrative and application web interfaces are not exposed to untrusted networks unless explicitly required and protected by access controls. Run authenticated vulnerability checks or configuration audits rather than relying only on banner detection, because product banners may be hidden or inaccurate. Review Fortinet system and web logs after patching to ensure there are no continuing crashes, malformed cookie requests, or unexpected service restarts. Where exposure existed before remediation, perform an incident review for signs of exploitation rather than treating patching alone as sufficient.

Typical attack path

1. Scan the internet or internal address space for Fortinet FortiCamera, FortiMail, FortiNDR, FortiRecorder, or FortiVoice web interfaces.
2. Fingerprint the product and version using HTTP responses, TLS certificates, headers, login pages, or exposed service metadata.
3. Send one or more specially crafted HTTP requests containing a malicious hash cookie to the vulnerable endpoint.
4. Trigger the stack-based buffer overflow and gain arbitrary code or command execution on the appliance.
5. Execute basic discovery commands to identify privileges, product version, network interfaces, configuration files, and reachable internal systems.
6. Collect configuration, credentials, mail/voice/recording/security data, or authentication material stored on the appliance.
7. Deploy persistence or additional tooling, such as a web shell, backdoor process, cron task, modified startup script, or reverse shell.
8. Use the compromised appliance to pivot deeper into the network or to monitor, exfiltrate, or disrupt traffic handled by the device.

How to detect it

Review web access logs, reverse proxy logs, WAF logs, Fortinet system/event logs, crash logs, and endpoint/EDR telemetry where available for evidence of prior exploitation. Focus on HTTP requests with unusually long or malformed Cookie headers, especially cookies containing a hash parameter or repeated failed requests immediately followed by service crashes or restarts. Look for segmentation faults, stack-smashing messages, watchdog restarts, core dumps, or unexpected daemon restarts around the time of suspicious HTTP traffic. On the appliance, investigate unexpected files in temporary or web-accessible directories, modified startup scripts, new scheduled tasks, unfamiliar listening ports, outbound connections from the appliance to unknown hosts, and shell commands executed by web-facing service processes. Because exploitation can result in arbitrary command execution, also review for credential/configuration access, suspicious archive creation, log clearing, or attempts to disable security services. If the appliance was internet-facing before patching, assume logs may be incomplete and correlate with firewall, proxy, NetFlow, DNS, and authentication logs for connections to or from unusual external infrastructure.

• Cookie: hash=
• Cookie:hash=
• hash=
• SIGSEGV
• segmentation fault
• stack smashing detected
• core dumped
• watchdog
• /var/log
• /tmp/
• /var/tmp/
• /bin/sh
• /bin/bash
• /bin/busybox
• wget
• curl
• chmod +x
• nc -e
• /etc/crontab
• /etc/rc.local

What your security team should do

• Immediately inventory all FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice deployments, including appliances not directly internet-facing.
• Prioritize internet-facing, DMZ, and partner-accessible appliances for same-day upgrade or isolation because exploitation is unauthenticated and active in the wild.
• Upgrade to the applicable fixed vendor release for each product branch; do not leave unsupported or end-of-branch versions exposed.
• Restrict web management and application interfaces to trusted administrative networks, VPN, or allowlisted source ranges.
• Hunt historical logs for oversized or malformed Cookie headers, hash-cookie anomalies, service crashes, segmentation faults, and suspicious commands spawned by web-facing processes.
• If suspicious activity is found, preserve appliance logs and volatile evidence, rotate credentials and API keys stored on or passing through the appliance, and assess adjacent systems for lateral movement.
• Add SIEM detections for unusual HTTP Cookie lengths, repeated requests containing hash cookie parameters, appliance process crashes, and shell/process execution from web service parents.
• Treat unpatched appliances past the 2025-06-04 KEV deadline as urgent exceptions requiring executive visibility and documented compensating controls.