CVE-2025-32756

Fortinet products have a stack-based buffer overflow allowing remote code execution without authentication, and are currently being exploited in the wild.

Multiple Fortinet products (FortiFone, FortiVoice, FortiNDR, FortiMail) contain a remotely exploitable buffer overflow, enabling arbitrary code execution. DIB organizations using these products face immediate risk of compromise and potential CMMC compliance failures if not promptly patched. Immediate patching and vulnerability scanning are required.

Shame score — The vulnerability's exploitation in the wild and lack of authentication requirements demonstrate a significant security oversight by Fortinet.