CVE-2025-67604

Published: May 12, 2026Modified: Oct 14, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.6 / Impact: 3.6

Source: psirt@fortinet.com (Secondary)

Description

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.

Affected (6)

Products: Fortinet: Fortianalyzer, Fortimanager

Fortinet

2 products

Fortianalyzer

Fortimanager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	7.2.0 ≤ version ≤ 7.2.12
Fortinet Fortianalyzer	7.4.0 ≤ version < 7.4.9
Fortinet Fortianalyzer	7.6.0 ≤ version < 7.6.5
Fortinet Fortimanager	7.2.0 ≤ version ≤ 7.2.12
Fortinet Fortimanager	7.4.0 ≤ version < 7.4.9
Fortinet Fortimanager	7.6.0 ≤ version < 7.6.5

Related CWEs

CWE-676

Use of Potentially Dangerous Function

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-26-137

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.