CVE-2025-67604
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. Exploitation depends on internal locks being aligned, which is out of the attacker's control.
Risk Assessment
An authenticated attacker could cause a system hang in FortiAnalyzer or FortiManager, potentially disrupting security monitoring and management operations in the organization.
Recommendation
Update FortiAnalyzer and FortiManager to the latest versions that do not contain this vulnerability, following Fortinet's guidance.
Other vulnerabilities in Fortinet FortiAnalyzer/FortiManager
See all- CVE-2026-23707High
An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer and FortiManager (including Cloud versions) allows a low-privileged user to execute arbitrary commands via crafted requests. It affects multiple versions of Fortinet software.
- CVE-2026-23705High
An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer and FortiManager allows a low-privileged user to execute arbitrary commands via crafted requests. It affects multiple versions of these products.
- CVE-2025-68649Medium
A path traversal vulnerability in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. The issue stems from improper limitation of a pathname to a restricted directory.
Original NVD description (English source)
A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS