CVE-2025-32766

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 7.6.0, <= 7.6.3; >= 7.4.1, <= 7.4.8

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-383Vendor Advisory

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-32779.8An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer.CVE-2025-327765.5OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specia CVE-2025-327778.2Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12 CVE-2025-327789.3Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web C CVE-2025-327796.5E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with ac CVE-2025-32789.8The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to th CVE-2025-327807.3BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijackin CVE-2025-327816.5Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Po CVE-2025-327825.3Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request tr CVE-2025-327834.3XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wi CVE-2025-327847.5conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condit CVE-2025-327855.4Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi