Fortinet FortiOS Flaw CVE-2025-25249 Exploited Since July…

What Happened

A critical heap-based buffer overflow in Fortinet's CAPWAP controller daemon has been under active attack since at least July 2026, and on 9 September CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 12 September. The flaw, tracked as CVE-2025-25249, was disclosed when Fortinet published advisory FG-IR-25-084 in January 2026. What changed is the evidence of exploitation: SOCRadar's Threat Research Unit published an analysis on 8 September that ties the vulnerability to a bespoke post-exploitation toolkit its researchers call PivotC2.

The bug lives in cw_acd, the daemon that speaks CAPWAP to managed FortiAP wireless access points. A remote, unauthenticated attacker who can reach the CAPWAP control port sends crafted packets that corrupt heap memory and ultimately run code in the context of the daemon. There is no login step and no user interaction. That combination, on a device that sits at the network edge, is why CISA gave federal agencies three days rather than the usual weeks.

Sources disagree on severity. The National Vulnerability Database scores it 9.8 critical with an AV:N/AC:L vector. Fortinet's own CNA record rates it 8.1 high, arguing higher attack complexity (AC:H). Several trackers reproduced a 7.3 or 7.4 figure. The operational read does not change with the number: the flaw is remotely reachable, needs no authentication, and is being exploited today.

Who Is Affected

FG-IR-25-084 covers a wide swath of the FortiOS line. Vulnerable trains are FortiOS 6.4 (all versions), 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. FortiSwitchManager 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6 are also affected. The FortiSASE 25.1.a and 25.2.b cloud releases were affected as well, but Fortinet has already remediated them in 25.1.b and 25.2.c, so no customer action is required.

Fixed builds that have shipped are FortiOS 7.0.18, 7.2.12, 7.4.9, and 7.6.4, and FortiSwitchManager 7.0.6 and 7.2.7. FortiOS 8.0.0 is listed as upcoming, not shipped. FortiOS 6.4 has no fixed build listed, so anyone on that train must migrate to a fixed release. The exposure hinges on configuration. The cw_acd daemon answers CAPWAP control traffic on interfaces where the Security Fabric Connection service is permitted in allowaccess. Since FortiOS 6.4 that single fabric keyword bundles FortiTelemetry and CAPWAP, so an interface enabled for fabric management is also listening for CAPWAP whether or not you run FortiAPs on it. Any such interface reachable from the internet is a candidate.

How the Attack Works

SOCRadar's reconstruction shows a disciplined chain rather than a smash-and-grab. The initial exploit ships as a self-extracting Linux binary the actors named fortirun.bin, which unpacks a Python runtime and helper modules. It first defeats address space layout randomization by reading memory pointers leaked in CAPWAP discovery responses, then grooms the heap with a sequence of crafted control messages so that a final oversized "Image Data" message overwrites an adjacent free-list structure. From that write primitive the exploit builds a return-oriented programming chain and pivots execution into a Node.js reverse shell.

That shell pulls down PivotC2, a Node.js implant SOCRadar tracks at version 0.2.3. It writes a stager to /tmp/.i.js, decodes it with a trivial XOR key, and runs as a detached background process. Command and control rides a single persistent TLS connection using a custom binary framing protocol with channel multiplexing and heartbeats, which lets one connection carry shells, file transfers, SOCKS5 and HTTP proxying, port forwarding, and network scans. The mechanics of turning that memory corruption into a running process are the subject of our companion explainer, How a Heap Overflow in a Network Daemon Becomes Code Execution.

The Credential Problem

PivotC2 is built specifically to strip a FortiGate of its secrets. It reads the device's compressed configuration files, locates the encrypted credential blobs, and decrypts them using both a hardcoded AES-256-CBC key and an AES-128-GCM key derived from the appliance's own key file. The result is plaintext VPN pre-shared keys, SSL-VPN user credentials, wireless passwords, LDAP bind secrets, and administrator accounts. In two confirmed intrusions against US organizations, SOCRadar traced the operators from harvested firewall credentials into full network compromise, including remote-desktop abuse, browser credential theft, and exfiltration of Microsoft Exchange mailbox data to cloud storage.

That is why patching alone is not enough. Anything the box held should be considered exposed, a point we develop in After a Firewall Breach, Assume Every Stored Credential Is Compromised.

Immediate Actions

Patch first. If you run FortiOS 6.4, there is no fixed 6.4 build, so migrate to a fixed release. On the other affected trains, upgrade to the listed fixed builds: FortiOS 7.0.18, 7.2.12, 7.4.9, or 7.6.4, and FortiSwitchManager 7.0.6 or 7.2.7. Where you cannot patch immediately, apply Fortinet's workaround: remove fabric from allowaccess on any interface that does not need it, or add a local-in policy that blocks CAPWAP-CONTROL on UDP ports 5246 through 5249 from untrusted sources. Reducing what the appliance exposes to the internet is a broader discipline covered in How to Find and Restrict the Services Your Firewall Exposes.

Then hunt. SOCRadar's indicators include the C2 addresses 46.151.29.58 and 146.103.99.177, and the on-device artifact /tmp/.i.js. From the FortiOS shell you can list active sessions to those addresses and check for the stager file and unexpected Node.js processes. Because the KEV clock is short, pair this with the process in How to Triage a CISA KEV Addition in 72 Hours. If you find artifacts, rotate every stored credential and follow a structured rebuild rather than a hopeful reboot, as in How to Rebuild a Compromised VPN Appliance.

Long-Term Outlook

Two things make this campaign notable beyond the CVE. First, the actors weaponized a bug that had been patched for six months, a reminder that a fix in the release notes is not a fix on the device. Second, SOCRadar assessed with the code comments and operational guidance it recovered that the operators likely used AI tooling to accelerate building the RAT and its intrusion workflow. The tradecraft still points to a Russian-speaking, financially motivated crew, distinct from the earlier FortiBleed activity. But the productivity signal is worth watching: the gap between a public patch and a polished, mass-scale exploitation kit is getting shorter, and edge appliances remain the front door.

Sources

CISA, Known Exploited Vulnerabilities Catalog (feed, catalog version 2026.09.10): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
CISA alert, "CISA Adds Four Known Exploited Vulnerabilities to Catalog," 9 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
NVD, CVE-2025-25249: https://nvd.nist.gov/vuln/detail/CVE-2025-25249
Fortinet PSIRT, FG-IR-25-084: https://www.fortiguard.com/psirt/FG-IR-25-084
SOCRadar, "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT," 8 September 2026: https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
SecurityWeek, "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks": https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/