CVE-2025-25249

What is FortiOS?

FortiOS is the operating system that runs on Fortinet's FortiGate firewalls and SD-WAN appliances, the network perimeter device for a large share of enterprises and government agencies. FortiSwitchManager centrally manages FortiSwitch fabric switches, and FortiSASE extends the same stack to cloud-delivered secure access. A perimeter firewall is a high-value target because compromise gives an attacker a foothold at the network boundary, with the ability to inspect traffic, alter routing, and pivot inward. Fortinet appliances have been among the most frequently exploited edge devices in recent years.

Overview

CVE-2025-25249 is a heap-based buffer overflow (CWE-122) in FortiOS, FortiSwitchManager, and FortiSASE that allows an unauthenticated remote attacker to execute code or commands by sending specially crafted packets. It is rated CVSS 8.1 with high attack complexity. Fortinet published fixes on 2026-01-13, but exploitation was not reported publicly until September 2026, when SOCRadar documented a campaign deploying a custom remote access trojan. CISA added the CVE to KEV on 2026-09-09.

Affected Versions

FortiSASE is updated by Fortinet as a cloud service. Consult FG-IR-25-084 for the definitive affected-version matrix.

Technical Details

The vulnerability is a heap-based buffer overflow in FortiOS packet-processing logic, reported to reside in the CAPWAP (Control And Provisioning of Wireless Access Points) wireless controller daemon. Insufficient bounds checking lets an attacker write past an allocated heap buffer with crafted packets, corrupting adjacent heap metadata and, in a successful exploit, hijacking execution flow to run attacker code.

Attack characteristics:

• Authentication: none required
• Complexity: high (CVSS AC:H); reliable exploitation depends on heap state
• Vector: network, via crafted packets to the affected service
• Impact: code or command execution (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

The high-complexity rating reflects that heap-overflow exploitation of FortiOS is not a single deterministic request; it requires shaping memory. That did not prevent weaponization, but it raises the bar relative to the logic-flaw bugs in the same KEV batch.

Discovery

The vulnerability was disclosed through Fortinet's routine PSIRT process as FG-IR-25-084 on 2026-01-13, without a named external researcher in available reporting. The in-the-wild exploitation was later identified and publicized by the threat-intelligence firm SOCRadar.

Exploitation Context

SOCRadar reported active exploitation dating to roughly July 2026, about six months after the patch. The campaign deployed PivotC2, a Node.js-based post-exploitation RAT for FortiGate devices that provides an interactive shell, traffic tunneling, network scanning, and configuration harvesting. SOCRadar reported more than 30,000 IP addresses targeted, 178 confirmed PivotC2 infections concentrated among United States entities, and at least two confirmed data-exfiltration intrusions, attributing the activity to a likely Russian-speaking cybercrime actor. No public proof of concept was reported.

Remediation

1. Upgrade to FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18, and FortiSwitchManager 7.2.7 or 7.0.6. Migrate off FortiOS 6.4 entirely, since it does not receive a fix on this branch.
2. Hunt for PivotC2 on FortiGate devices: look for unexpected Node.js processes, unfamiliar scheduled tasks, and configuration changes you did not make. Audit outbound connections for unusual tunneling to unfamiliar hosts.
3. Restrict administrative and management access to trusted networks, and disable internet-facing services that are not required, to reduce reachability of the vulnerable daemon.
4. Rotate credentials stored on or fronted by the appliance if any indicator is found, including admin passwords, VPN and SSO secrets, and API keys.
5. Treat six-month-old edge patches as exploited until proven otherwise. The gap between Fortinet's January fix and September exploitation reporting means unpatched devices had a long exposure window.