Fortinet CVE-2025-25249 Exploited at Scale to Install PivotC2 RAT

Attackers scanned more than 30,000 IP addresses

Threat actors are actively exploiting CVE-2025-25249, an unauthenticated remote code execution vulnerability affecting multiple Fortinet products, to compromise network security appliances and install the PivotC2 remote access trojan.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 9, 2026. US federal agencies must complete remediation by September 12, 2026, giving them three days to address exposed systems and perform the required forensic triage.

SOCRadar’s investigation, reported by SecurityWeek, found that the campaign targeted more than 30,000 IP addresses and successfully infected 178 devices. Most targets were located in the United States, and at least two confirmed intrusions led to data exfiltration.

The activity has been attributed with limited confidence to a likely Russian-speaking cybercrime actor. Researchers also assess that PivotC2 was probably created with AI assistance, although the evidence supporting that conclusion has not been disclosed. The malware has reportedly appeared in attacks since at least July 2026.

A heap overflow opens the door without credentials

CVE-2025-25249 is a heap-based buffer overflow that can be triggered remotely without authentication. An attacker sends specially crafted packets or requests to an affected product, causing data to be written beyond the allocated boundary of a heap buffer.

The vulnerability is mapped to CWE-122, covering heap-based buffer overflows, and CWE-787, covering out-of-bounds writes. Successful exploitation allows the attacker to run unauthorized code or commands on the targeted appliance.

No user interaction is required. The NVD CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, producing a base score of 8.1. That vector reflects network accessibility, no required privileges, no user action and potentially severe effects on confidentiality, integrity and availability. Attack complexity is rated high.

A separate assessment cited by SecurityWeek assigns the flaw a CVSS score of 7.4. CISA does not provide a score in its KEV entry. The scoring difference does not change the operational status: exploitation has been observed in the wild.

Publicly available reporting does not identify the precise protocol, packet structure or memory-corruption sequence used by the attackers. It also does not describe any prerequisites beyond access to a vulnerable service. Organizations should therefore avoid building exposure decisions around an assumed port or interface that has not been confirmed.

FortiOS, FortiSwitchManager and FortiSASE are affected

CISA identifies Fortinet FortiOS, FortiSwitchManager and FortiSASE as affected products. The documented vulnerable ranges include:

• FortiOS 7.6.0 through 7.6.3
• FortiOS 7.4.0 through 7.4.8
• FortiOS 7.2.0 through 7.2.11
• FortiOS 7.0.0 through 7.0.17
• FortiOS 6.4, all versions according to one NVD range
• FortiSwitchManager 7.2.0 through 7.2.6
• FortiSwitchManager 7.0.0 through 7.0.5
• FortiSASE 25.1.39

The reported fixed releases are FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, plus FortiSwitchManager 7.2.7 and 7.0.6. Administrators should install these versions or newer supported releases.

There is an unresolved inconsistency around the FortiOS 6.4 branch. NVD product data uses the threshold “FortiOS below 6.4.17,” suggesting that 6.4.17 is the first fixed release on that branch. However, the separately reported patch list does not include a fixed 6.4.x version. Organizations still running FortiOS 6.4 should verify the correct upgrade path directly against Fortinet’s advisory rather than relying on the shorter patch list alone.

FortiSASE also requires special attention. CISA and NVD include it among the affected products, but no corresponding fixed FortiSASE version has been disclosed in the available reporting. Customers should obtain the applicable mitigation or service update from Fortinet.

The flaw was reportedly patched in January, but the year is not specified. That missing date does not affect the current response requirement or the evidence of active exploitation.

PivotC2 turns a compromised gateway into an internal foothold

PivotC2 is a Node.js-based RAT described as a FortiGate post-exploitation tool. Once installed, it gives an operator interactive shell access and capabilities designed to extend control beyond the initially compromised appliance.

Reported functions include:

• Interactive command execution
• Traffic tunneling
• Internal network scanning
• Device configuration harvesting

Those capabilities make an infected gateway particularly useful for lateral movement. Traffic tunneling can route attacker communications through the compromised device, while network scanning can identify reachable internal systems. Configuration collection may expose network topology, administrative settings or other information useful for subsequent operations.

The confirmed infections represent a small portion of the more than 30,000 targeted IP addresses, but the campaign still produced 178 compromised devices. The two known data-exfiltration cases show that exploitation did not stop at vulnerability validation or malware installation.

The full scope may be larger. No information is available about how the 178 infections were confirmed, how long attackers remained present, or whether all targeted addresses represented vulnerable and reachable systems.

KEV status creates an immediate forensic requirement

CISA’s KEV listing establishes that CVE-2025-25249 is not merely exploitable in theory. Federal agencies must remediate it by September 12, 2026 under BOD 26-04, while also following CISA’s Forensics Triage Requirements.

The KEV entry marks association with ransomware campaigns as unknown. That field does not connect PivotC2 activity to ransomware, nor does it exclude such use.

CISA instructs affected organizations to apply vendor mitigations, assess each asset’s internet exposure and follow the applicable BOD 26-04 guidance for cloud services. If no mitigation is available, the required action is to discontinue use of the affected product.

Although the binding deadline applies to US federal agencies, private organizations face the same exploitation path. Internet-facing Fortinet appliances should receive the highest priority, followed by systems reachable from untrusted or partner networks.

Patch first, then investigate possible compromise

Administrators should immediately inventory FortiOS, FortiSwitchManager and FortiSASE deployments, including appliances that may not appear in standard endpoint-management platforms. Each identified asset should be checked against the vulnerable ranges and upgraded using Fortinet’s instructions.

Patching alone cannot establish that a previously exposed device is clean. Organizations should perform forensic triage on systems that were reachable while vulnerable, especially where configuration changes, unexplained processes, tunneling activity or unusual internal scanning are observed.

No hashes, domains, IP addresses, file paths, process names or network signatures for PivotC2 have been disclosed. No specific workaround is currently available either. The malware name and its reported behavior are therefore the only public detection leads.

Defenders should preserve relevant device logs before upgrading where operationally possible, review administrative and configuration history, and examine surrounding network telemetry for unexpected outbound connections or scanning originating from Fortinet appliances. Any indication of shell access, unauthorized configuration collection or traffic relaying should trigger a broader incident response.

Where a supported fixed release cannot be installed, organizations should apply Fortinet’s documented mitigation. If none exists, removing the product from service is the prescribed CISA action.