CVE-2025-32932: Fortinet FortiSOAR XSS Vulnerability

CVE-2025-32932 Overview

CVE-2025-32932 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Fortinet FortiSOAR. The flaw exists in the web UI service request functionality across multiple product versions. An authenticated remote attacker can inject malicious script content into stored service requests. When another user views the affected page, the browser executes the attacker-controlled payload.

The vulnerability affects FortiSOAR 7.6.1 and below, 7.5.1 and below, and all versions of 7.4, 7.3, 7.2, 7.0, and 6.4. Fortinet published advisory FG-IR-24-513 with remediation guidance.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browser context of FortiSOAR users, enabling session theft, UI manipulation, and abuse of SOAR playbook privileges.

Affected Products

• Fortinet FortiSOAR 7.6.1 and below
• Fortinet FortiSOAR 7.5.1 and below
• Fortinet FortiSOAR 7.4, 7.3, 7.2, 7.0, and 6.4 (all versions)

Discovery Timeline

• 2025-08-12 - CVE-2025-32932 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32932

Vulnerability Analysis

CVE-2025-32932 is a stored cross-site scripting flaw in the FortiSOAR web interface. The application accepts user-supplied input in service request records without adequate sanitization. FortiSOAR stores this input in the backend and later renders it in the browser without proper output encoding.

Because the payload is persisted, every user who loads the affected service request view triggers execution of the attacker's script. FortiSOAR is a security orchestration platform where analysts hold elevated permissions, so script execution against these accounts carries meaningful risk. Successful exploitation can allow session cookie theft, forced playbook execution, or manipulation of case data within analyst workflows.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as CWE-79. The service request module fails to encode HTML metacharacters such as <, >, and " before writing them into the DOM. Any HTML or JavaScript submitted through vulnerable fields is preserved and returned verbatim when the record is rendered.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify service requests. The attacker submits a request containing a script payload in a stored field. When a privileged user, such as a SOC analyst or administrator, opens the request, the browser executes the payload in the context of the FortiSOAR origin. User interaction is required, which limits opportunistic mass exploitation but is trivial to achieve in a workflow-driven SOAR environment.

The vulnerability has a changed scope, meaning script execution affects resources beyond the vulnerable component itself, including any browser context sharing the FortiSOAR session. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-32932

Indicators of Compromise

• Service request records containing HTML tags such as <script>, <img>, <svg>, or onerror= handlers in fields that should hold plain text.
• Outbound HTTP requests from analyst browsers to unfamiliar domains immediately after loading a FortiSOAR service request.
• Unexpected session activity or playbook execution originating from analyst accounts shortly after viewing user-submitted records.

Detection Strategies

• Review FortiSOAR audit logs for service request creation events by low-privilege accounts, then correlate with subsequent record views by administrators.
• Deploy a Content Security Policy report-only header and monitor report-uri submissions for inline script violations in the FortiSOAR UI.
• Perform database queries against service request text fields searching for angle brackets and JavaScript event handler substrings.

Monitoring Recommendations

• Forward FortiSOAR application and web server logs to a centralized analytics platform for retention and correlation.
• Alert on anomalous browser sessions that generate unexpected outbound traffic while an operator is authenticated to the SOAR console.
• Track privilege changes and playbook modifications that follow interaction with user-supplied service request content.

How to Mitigate CVE-2025-32932

Immediate Actions Required

• Upgrade FortiSOAR to a fixed release per Fortinet advisory FG-IR-24-513.
• Audit existing service request records for previously stored script payloads and remove or sanitize any malicious content.
• Restrict service request creation permissions to trusted roles until the patch is deployed.

Patch Information

Fortinet has released updated FortiSOAR builds that address CVE-2025-32932. Consult Fortinet Security Advisory FG-IR-24-513 for the specific fixed version numbers corresponding to each affected branch. Upgrading versions 6.4, 7.0, 7.2, 7.3, and 7.4 requires migration to a supported branch because these lines have no patched release.

Workarounds

• Enforce a strict Content Security Policy on the FortiSOAR web UI to block inline scripts and untrusted script sources.
• Require multi-factor authentication for all FortiSOAR accounts to raise the cost of credential-based access needed to plant payloads.
• Segregate service request submission workflows so unprivileged submitters cannot influence records viewed by administrators.

# Example Content Security Policy header applied at the reverse proxy in front of FortiSOAR
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'";