Fortinet Security Updates – 14 May 2025

The addressed vulnerabilities could allow the attacker to bypass security restrictions, gain elevated privileges, perform denial of service attacks, gain access to sensitive information, and gain access to the affected product.

Sample of the addressed vulnerabilities:

1. Stack-Based Buffer Overflow Vulnerability in API (CVE-2025-32756):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. TACACS+ Authentication Bypass Vulnerability (CVE-2025-22252):

• CVSS: 9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Privileges

Sample of the affected products:

• FortiOS 7.4.4 through 7.4.6.
• FortiProxy 7.6.0 through 7.6.1.
• FortiSwitchManager 7.2.5.
• FortiSandbox 4.4.0 through 4.4.4.

It should be highlighted that Fortinet is aware that the zero-day vulnerability “CVE-2025-32756” across FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera is being exploited in the wild.