CVE-2025-32756: Exploitation of Critical Severity Zero-Day Vulnerability in Fortinet FortiVoice

On 13 May 2025, Fortinet published a security advisory on a critical severity stack-based overflow vulnerability, CVE-2025-32756, impacting FortiVoice, FortiCamera, FortiMail, FortiNDR, and FortiRecorder. The vulnerability allows remote unauthenticated threat actors to execute arbitrary code or commands via crafted HTTP requests. 

In the advisory Fortinet stated that the vulnerability has been exploited in the wild on FortiVoice. The advisory includes indicators of compromise (IoCs), also disclosing that in observed attacks threat actors have deployed malware on compromised devices, stolen credentials via cron jobs, and utilised scripts to conduct network reconnaissance. 

As threat actors have a history of targeting Fortinet products, exploitation will likely continue and may include additional affected products. 

Recommendations for CVE-2025-32756

Upgrade to Latest Fixed Version

Arctic Wolf strongly recommends that customers upgrade the Fortinet products to the latest fixed version. 

Note: As all versions of FortiCamera 2.0, FortiCamera 1.1, FortiNDR 7.1, FortiNDR 1.5, FortiNDR 1.4, FortiNDR 1.3, FortiNDR 1.2, and FortiNDR 1.1 are affected by the vulnerability, Fortinet recommends customers migrate to a fixed release. 

Please follow your organisation’s patching and testing guidelines to minimise potential operational impact. 

Workaround 

For users unable to immediately upgrade to a fixed version, Fortinet recommends disabling the HTTP/HTTPS administrative interface. 

References 

• Security Advisory

Resources

Understand the threat landscape, and how to better defend your organization, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilizes threat intelligence to harden your attack surface and stop threats earlier and faster