Medium5.2Fortinet

Medium [CVE-2025-67604] DoS due to unsafe function in signal handler

This medium-severity Fortinet advisory covers CVE-2025-67604 affecting FortiManager, FortiAnalyzer.

FG-IR-26-137 Published May 12, 2026Updated by vendor May 12, 2026

CVE-2025-67604

Affected products & platforms

FortinetFortiManagerFortiAnalyzer

Open vendor advisory

Android app · Google Play

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

CVSSv3 Score:

5.2

A use of potentially Dangerous Function vulnerability [CWE-676] in FortiAnalyzer and FortiManager API may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.

Revised on 2026-05-12 00:00:00

Affected versions

FortiAnalyzer 7.6: 7.6.0 through 7.6.4
FortiAnalyzer 7.4: 7.4.0 through 7.4.8
FortiAnalyzer 7.2: 7.2 all versions
FortiAnalyzer 7.0: 7.0 all versions
FortiAnalyzer 6.4: 6.4 all versions
FortiManager 7.6: 7.6.0 through 7.6.4
FortiManager 7.4: 7.4.0 through 7.4.8
FortiManager 7.2: 7.2 all versions
FortiManager 7.0: 7.0 all versions
FortiManager 6.4: 6.4 all versions

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

FortiAnalyzer 7.6: 7.6.5
FortiAnalyzer 7.4: 7.4.9
FortiAnalyzer 7.2: migrate to a fixed release
FortiAnalyzer 7.0: migrate to a fixed release
FortiAnalyzer 6.4: migrate to a fixed release
FortiManager 7.6: 7.6.5
FortiManager 7.4: 7.4.9
FortiManager 7.2: migrate to a fixed release
FortiManager 7.0: migrate to a fixed release
FortiManager 6.4: migrate to a fixed release

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade per the Affected/Solution table: FortiAnalyzer 7.6: 7.6.5; FortiAnalyzer 7.4: 7.4.9; FortiAnalyzer 7.2: migrate to a fixed release; FortiAnalyzer 7.0: migrate to a fixed release; FortiAnalyzer 6.4: migrate to a fixed release; ….

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Sources

Official and corroborating records used to build this advisory.

FortiGuard PSIRT Advisoriesofficial
Official vendor feed — the source of truth for this advisory. VulnPulse polled this feed and parsed this entry from it. Discovered from the machine-readable feed https://filestore.fortinet.com/fortiguard/rss/ir.xml; this link opens the Fortinet advisory index instead of the raw feed document.
Fortinet
Vendor advisory pageofficial
Advisory page fetched and parsed to extract affected/fixed versions and mitigation guidance beyond what the feed carries.
Fortinet

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2025-67604NVD CVE.org MITRE

Official resources

FortiManager documentation & upgrade guides
Official documentation
This advisory names 7.6 / 7.4 / 7.2 as the first fixed releases — official upgrade documentation for FortiManager.
FortiAnalyzer documentation & upgrade guides
Official documentation
This advisory names 7.6 / 7.4 / 7.2 as the first fixed releases — official upgrade documentation for FortiAnalyzer.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.