CVE-2025-67604

EUVD-2025-209804

12.05.2026, 18:16

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 33%

Affected Products (NVD)

Vendor	Product	Version
fortinet	fortianalyzer	7.2.0 ≤ 𝑥 ≤ 7.2.12
fortinet	fortianalyzer	7.4.0 ≤ 𝑥 < 7.4.9
fortinet	fortianalyzer	7.6.0 ≤ 𝑥 < 7.6.5
fortinet	fortimanager	7.2.0 ≤ 𝑥 ≤ 7.2.12
fortinet	fortimanager	7.4.0 ≤ 𝑥 < 7.4.9
fortinet	fortimanager	7.6.0 ≤ 𝑥 < 7.6.5

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-676 - Use of Potentially Dangerous Function
The program invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-137