PT-2026-40111 · Fortinet · Fortimanager+1

Published 2026-05-12 · Updated 2026-05-15 · CVE-2025-67604

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.8 FortiAnalyzer version 7.2 FortiAnalyzer version 7.0 FortiAnalyzer version 6.4 FortiManager versions 7.6.0 through 7.6.4 FortiManager versions 7.4.0 through 7.4.8 FortiManager version 7.2 FortiManager version 7.0 FortiManager version 6.4

Description The use of potentially dangerous functions in the management interface may allow an authenticated remote attacker to cause a system hang or denial of service. This occurs when multiple specially crafted HTTP requests cause crashes, provided that internal locks are aligned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-676

Related Identifiers

BDU:2026-06795

CVE-2025-67604

Affected Products

Fortianalyzer

Fortimanager

References · 5

• https://bdu.fstec.ru/vul/2026-06795 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67604 · Security Note
• https://t.me/cveNotify/163624 · Telegram Post
• https://twitter.com/CCBalert/status/2054823139465474249 · Twitter Post