CVE-2025-25249
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 9, 2026
- US federal agencies must remediate it by Sep 12, 2026 (BOD 22-01)
- First attack observed 237 days after disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 9, 2026 Sep 8, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| fortinet | fortios | < 7.0.18 |
| fortinet | fortiswitchmanager | < 7.0.6 |
| fortinet | fortisase | 25.1.39 |
| siemens | ruggedcom ape1808 firmware | - |
| siemens | ruggedcom ape1808 | - |
Related articles
FortiMail and NetScaler Exploitation Drives an Urgent Enterprise Patch Cycle
FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.
Three Exploited Linux Kernel Flaws Trigger Immediate CISA Patch Deadline
CISA flags three exploited Linux kernel flaws in TLS, AF_ALG and ebtables, setting a September 21, 2026 patch deadline for federal agencies.
NightEagle, Hacking Cat, and Toy Ghouls Target Russian Networks
Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian firms with Exchange exploits, backdoors, ransomware and wipers.
Critical ScreenConnect Flaw Fuels Worm-Like Attacks Through Active Remote Sessions
CVE-2026-84869 lets attackers execute files via active ScreenConnect sessions in worm-like attacks. Patch clients to 26.6.5.9742 now.
Fortinet CVE-2025-25249 Exploited at Scale to Install PivotC2 RAT
Attackers exploit Fortinet CVE-2025-25249 RCE flaw at scale, scanning 30,000+ IPs to install PivotC2 RAT on 178 devices for tunneling and data theft.
This product uses the NVD API but is not endorsed or certified by the NVD.