Is CVE-2025-32756 being actively exploited?

Yes. CVE-2025-32756 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 14, 2025.

What is the CVSS score for CVE-2025-32756?

CVE-2025-32756 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2025-32756

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 30.7%EU EUVD: exploited

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-121
EPSS score: 30.7% (98th percentile)
In CISA KEV: Yes, added May 14, 2025
In EU EUVD: Yes (EUVD-2025-14705)
Published: May 13, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Added to the KEV catalog on May 14, 2025; federal remediation due June 4, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-14705 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / forticamera
fortinet / forticamera firmware
fortinet / fortimail
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortindr
fortinet / fortirecorder
fortinet / fortivoice
fortinet / fortivoice

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

FortiMail 7.4 - Fortinet, Inc. - Common Criteria CCEVS-VR-VID-11462-2024 - archived

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-254(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain