Reported by 9 outlets
FortiGate CVE-2025-25249 now delivering PivotC2 RAT
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.40 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, the CAPWAP control service listening on UDP 5246, exploitable by any unauthenticated attacker who can reach the port. Fortinet disclosed and patched it in advisory FG-IR-25-084 on January 13, 2026, rating it CVSSv3 7.4 while NVD scores the same bug Critical at 9.8. SOCRadar's Threat Research Unit has confirmed exploitation running since at least July 2026: a custom binary, fortirun.bin, fingerprints thirteen FortiGate models through CAPWAP discovery responses, defeats ASLR using memory addresses the daemon itself leaks, and lands a reverse shell through the Node.js runtime FortiOS ships with. The payload, PivotC2 v0.2.3, is a Node.js RAT assessed as AI-assisted, carrying interactive shells, SOCKS5 and HTTP tunneling, port forwarding, CIDR scanning, and decryption of the ENC fields in harvested FortiGate configurations. CISA added the CVE to the KEV catalog on September 9, 2026 with a September 12 remediation deadline under BOD 26-04.
The number that matters is the ratio: up to 30,000 targeted addresses produced 178 confirmed infections, which means a patient operator working a list, not a spray-and-pray scan, and the January patch date offers no comfort because these victims were exploited eight months after the fix existed. What the events undersell is the cascade after the firewall falls: two US intrusions moved into Active Directory enumeration, Chrome and Edge credential theft, RDP-enabling registry changes, and Exchange mailbox archive exfiltration to attacker cloud storage, all fed by PivotC2's config decryption, which turns one vulnerable appliance into valid SSL-VPN credentials, LDAP bind secrets, wireless PSKs, and admin accounts that outlive the reimage. The auto-mode flag makes this hands-off: every new beacon is registered, harvested, mapped, and scanned without an operator touching a keyboard. This campaign shares no infrastructure or victims with FortiBleed, so it is a second independent playbook aimed at Fortinet edge devices, and the high-confidence attribution to a Russian-speaking, financially motivated group that is also probing FortiManager, PeopleSoft, and ArubaOS suggests the 178 boxes are the opening move, not the objective.
Confirm the running release with get system status and upgrade to FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18, or 6.4.17 as the branch allows, FortiSwitchManager 7.2.7 or 7.0.6, and a fixed FortiSASE build; the advisory removed 6.4.17 from its fixed list on February 23, 2026, so anyone still on 6.4 plans a migration rather than a point upgrade. Where patching must wait, strip fabric from allowaccess on internet-facing interfaces and drop inbound UDP 5246-5249 with a local-in policy scoped to trusted CAPWAP devices. Hunt every exposed appliance, not just suspects: diagnose sys session filter daddr 146.103.99.177 and 46.151.29.58, fnsysctl ls -la /tmp/.i.js and /tmp/, and diagnose sys process list | grep node, keeping in mind that a node process alone proves nothing since FortiOS legitimately runs Node.js in its management plane. Any hit means the configuration is gone: rotate administrative, SSL-VPN, LDAP bind, wireless, and IPsec secrets immediately, then sweep internal hosts for RDP registry edits, reverse SSH tunnels, browser credential access, and Exchange archive transfers.
Two developments would change this assessment. A public exploit or leak of the fortirun.bin toolchain would collapse the skill barrier that kept infections at 178 of 30,000 and convert a targeted operation into mass opportunistic exploitation, and any confirmed sighting of the same operator against FortiManager, PeopleSoft, or ArubaOS would show the campaign is a portfolio rather than a single bug. The KEV entry also lists ransomware association as unknown; a linkage claim would raise the stakes for every organization still running an unpatched branch.
Timeline
-
original reporting
Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
gbhackers.com · 34d ago · September 9th, 2026
Threat actors are actively exploiting a critical vulnerability in FortiGate to deploy PivotC2, a Node. js-based remote access trojan (RAT) designed for persistent post-exploitation of FortiOS appliances. Researchers at SOCRadar’s Threat Research Unit (STRU) reported that this campaign has targeted over 30,000 internet-exposed FortiGate IP addresses and has successfully compromised at least 178 devices since […] The post Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
original reporting
CVE-2025-25249: A Patched FortiGate Flaw Is Now Delivering a Custom RAT Called PivotC2 If your organization runs a Fortinet FortiGate firewa
insomnisec.com · 34d ago · September 9th, 2026
CVE-2025-25249: A Patched FortiGate Flaw Is Now Delivering a Custom RAT Called PivotC2 If your organization runs a Fortinet FortiGate firewa
via Mastodon https://insomnisec.com/posts/2026-09-09-cve-2025-25249-pivotc2-fortigate_v2/
-
update from fortinet.com
Heap-based buffer overflow in cw_acd daemon (FG-IR-25-084)
fortinet.com · 274d ago · January 13th, 2026
The Fortinet PSIRT advisory behind the story's CVE, published January 13, 2026 (page date only) and last updated February 23, 2026. It documents CVE-2025-25249 as a heap-based buffer overflow (CWE-122) in the FortiOS and FortiSwitchManager cw_acd daemon allowing remote unauthenticated code execution via crafted requests, discovered internally by Gwendal Guegniaud, scored CVSSv3 7.4 with a temporal vector, and notes ASLR and PIE considerably raise exploitation effort. It lists affected branches and fixes: FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 or above, migration off 6.4, FortiSwitchManager 7.2.7 and 7.0.6 or above, and two workarounds: removing 'fabric' from interface allowaccess, or blocking CAPWAP-CONTROL on UDP ports 5246-5249 with local-in policies that admit only trusted devices.
-
update from nvd.nist.gov
NVD record for CVE-2025-25249 with CISA KEV listing
nvd.nist.gov · 274d ago · January 13th, 2026
NVD published the record on 2026-01-13 with Fortinet as CNA. NIST scores it 9.8 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while Fortinet's own CNA score on the same record is 8.1. The record's KEV table shows CISA added the vulnerability to the Known Exploited Vulnerabilities Catalog on 2026-09-09 with a remediation due date of 2026-09-12.
-
update from socradar.io
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
socradar.io · 35d ago · September 8th, 2026
SOCRadar's Threat Research Unit (STRU) published the original disclosure of the PivotC2 campaign on 2026-09-08, the day before the GBHackers and Cyberpress articles carried in this story. The report ties active exploitation of CVE-2025-25249 to PivotC2, a Node.js-based FortiGate post-exploitation RAT, and is the primary source both outlets cite for the 30,000-plus targeted IP addresses and 178 confirmed infections.
-
update from cyberpress.org
Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal Credentials
cyberpress.org · 34d ago · September 9th, 2026
SOCRadar Threat Research Unit (STRU) assessed with high confidence that exploitation began no later than July 2026 and remains active. The campaign reportedly targeted more than 30,000 FortiGate IP addresses and resulted in 178 confirmed PivotC2 infections, with the United States accounting for the largest concentration of affected systems. Fortinet appliances use CAPWAP to centrally manage wireless access points. The vulnerable cw_acd process is present in affected FortiOS releases, including versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, and all FortiOS 6.4 versions. Attackers use a self-extracting Linux exploit binary, fortirun.bin , with Bash and Python automation scripts. The tool fingerprints a target’s firmware and hardware configuration, abuses CAPWAP discovery responses to defeat ASLR protections , grooms the daemon heap, and corrupts linked-list pointers to gain an arbitrary-write primitive. It then hijacks execution
-
mentioned by cyberworldops.eu
Fortinet CVE-2025-25249, an unauthenticated heap-based buffer overflow RCE, is being exploited at scale to deploy PivotC2 RAT. CISA added it
cyberworldops.eu · 33d ago · September 10th, 2026
-
mentioned by www.cve.org
🔴 EXPLOITED CVE-2025-25249: A heap-based buffer overflow in Fortinet FortiOS and FortiSwitchManager allows unauthorized code execution via c
www.cve.org · 31d ago · September 12th, 2026
-
update from securityonline.info
Discover how the PivotC2 FortiGate RAT uses CVE-2025-25249 exploitation to harvest credentials and tunnel traffic across corporate network e
securityonline.info · 29d ago · September 14th, 2026
Discover how the PivotC2 FortiGate RAT uses CVE-2025-25249 exploitation to harvest credentials and tunnel traffic across corporate network e
via Mastodon http://securityonline.info/pivotc2-fortigate-rat/?utm_source=mastodon&utm_medium=jetpack_social