Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-25249 8.1
Fortinet · Multiple Products · Added 2026-09-09 · Published 2026-01-13
3-Day Required KEV Active Exploitation

Details

VulnerabilityFortinet Multiple Products Heap-based Buffer Overflow Vulnerability
VendorFortinet
ProductMultiple Products
Date added2026-09-09
Due date2026-09-12
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-122 CWE-787
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

NVD: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-09-09 20:30 UTC
Searches12
Component defaultyes
Sources https://fortiguard.fortinet.com/psirt/FG-IR-25-084
https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
https://arcticwolf.com/resources/blog/cve-2025-25249/
https://www.sentinelone.com/vulnerability-database/cve-2025-25249/
https://cybersecuritynews.com/fortigate-firewalls-hacked-to-deploy-malware/
https://kudelskisecurity.com/research/heap-based-buffer-overflow-in-fortinet-products
https://threatprotect.qualys.com/2026/01/14/fortios-and-fortiswitchmanager-code-execution-vulnerability-cve-2025-25249/

Hunting hypothesis agent

Hunt for oversized CAPWAP Control packets on UDP 5246 triggering heap overflow in cw_acd; monitor for fortirun.bin execution, Node.js processes, /tmp/.i.js artifacts, and unexpected TLS outbound connections from FortiGate

Research details

Componentcw_acd daemon (CAPWAP Wireless Aggregate Controller Daemon), CAPWAP Control service on UDP 5246
PreconditionsNetwork reachability to FortiGate/FortiSwitchManager management interface on UDP port 5246 (CAPWAP Control); no authentication required; target must run vulnerable FortiOS (6.4 through 7.6.3), FortiSwitchManager (7.0 through 7.2.6), or FortiSASE 25.1.x; cw_acd must be active (enabled by default when FortiAP management is configured) agent
DeliveryMalicious CAPWAP protocol packets sent over UDP port 5246 to the cw_acd daemon
Public PoCno
Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-25-084
Exploit notesCVSS attack complexity: HIGH | No public PoC available, but active exploitation confirmed in the wild by SOCRadar STRU (August 2026) using custom fortirun.bin binary and PivotC2 Node.js RAT; exploitation requires crafting malicious CAPWAP packets targeting the cw_acd daemon heap allocator
SummaryCVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon (CAPWAP protocol handler) of FortiOS and FortiSwitchManager, allowing unauthenticated remote code execution via crafted UDP packets to port 5246. Actively exploited in the wild since at least mid-2026 by a Russian-speaking threat actor deploying the PivotC2 Node.js RAT, which harvests FortiGate credentials and enables persistent remote access. Fortinet released patches in January 2026; organizations must upgrade immediately and restrict CAPWAP control traffic exposure.

Tia coverage

First reported2026-09-09
First exploit report2026-09-09
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-kev-update-september-9-2026fortigate-cve-2025-25249-now-delivering-pivotc2-ratfortinet-security-advisory-av26-023-update-1-2

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub