Fortinet Patches CVE-2025-32756 Zero-Day RCE Flaw Exploited in FortiVoice Systems

Keypoints

• Fortinet patched a critical zero-day vulnerability (CVE-2025-32756) actively exploited in attacks.
• The flaw is a stack-based overflow (CWE-121) that can allow remote, unauthenticated execution of arbitrary code.
• Targeted products include FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera, with specific versions requiring updates.
• Attackers performed device network scans, erased crash logs, and logged credentials through enabled debugging features.
• Fortinet identified threat activity originating from several IP addresses and did not disclose the attack scale or threat actors.
• Users are recommended to apply security patches immediately or temporarily disable HTTP/HTTPS interfaces to mitigate risk.
• The vulnerability was discovered by Fortinet’s security team based on active exploitation in the wild.