---
id: CVE-2025-67604
title: >-
  A use of potentially dangerous function vulnerability in Fortinet
  FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8,
  FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer
  6.4 all versions, Forti…
summary: >-
  A use of potentially dangerous function vulnerability in Fortinet
  FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8,
  FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer
  6.4 all versions, Forti…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-676
vendor: fortinet
product: fortianalyzer
affected:
  - 'fortianalyzer >= 7.2.0, <= 7.2.12'
  - 'fortianalyzer >= 7.4.0, < 7.4.9'
  - 'fortianalyzer >= 7.6.0, < 7.6.5'
  - 'fortimanager >= 7.2.0, <= 7.2.12'
  - 'fortimanager >= 7.4.0, < 7.4.9'
  - 'fortimanager >= 7.6.0, < 7.6.5'
patched:
  - fortianalyzer 7.6.5
  - fortimanager 7.6.5
published: '2026-05-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67604'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-137'
    label: psirt@fortinet.com
tags:
  - nvd
epss: 0.00424
epssPercentile: 0.34911
ingestedAt: '2026-10-14T13:30:58.497Z'
---

## Overview

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.

## Affected

- `fortianalyzer >= 7.2.0, <= 7.2.12`
- `fortianalyzer >= 7.4.0, < 7.4.9`
- `fortianalyzer >= 7.6.0, < 7.6.5`
- `fortimanager >= 7.2.0, <= 7.2.12`
- `fortimanager >= 7.4.0, < 7.4.9`
- `fortimanager >= 7.6.0, < 7.6.5`

## Remediation

Upgrade past the affected range:

- `fortianalyzer 7.6.5`
- `fortimanager 7.6.5`