Fortinet’s Zero-Day Nightmare: Critical Patch for FortiVoice Security Flaw
Fortinet patches a critical zero-day vulnerability in FortiVoice systems, exploited by attackers using IP addresses that might as well be on a world tour. The flaw allows remote code execution via malicious HTTP requests, proving once again that in the world of cybersecurity, the only safe phone call is a smoke signal.
Hot Take:
Fortinet’s been busy playing whack-a-mole with a critical bug that’s making enterprise phone systems sing the hacker blues. While FortiVoice users are singing “Hit Me Baby One More Time,” Fortinet engineers are feverishly rewriting the lyrics to “Can’t Touch This!”
Key Points:
- Fortinet released patches for a critical remote code execution vulnerability in FortiVoice systems.
- The vulnerability, CVE-2025-32756, affects multiple Fortinet products, including FortiMail and FortiRecorder.
- The flaw allows attackers to execute arbitrary code via malicious HTTP requests.
- Threat actors have been exploiting the vulnerability as a zero-day, launching attacks from known IP addresses.
- Fortinet advises disabling the HTTP/HTTPS administrative interface if updates can’t be installed immediately.
Already a member? Log in here