Fortinet FortiOS Flaw CVE-2025-25249 Exploited Since July to Drop the PivotC2 RAT

What Happened

A critical heap-based buffer overflowBuffer Overflow🛡️A vulnerability where a program writes data beyond the boundaries of allocated memory, potentially overwriting adjacent memory and allowing attackers to execute malicious code. in Fortinet's CAPWAPCAPWAP🌐Control and Provisioning of Wireless Access Points, a standard protocol that lets a controller manage remote wireless access points. On FortiOS the cw_acd daemon speaks CAPWAP, and enabling the Security Fabric service makes an interface listen for it on UDP ports 5246 to 5249. controller daemon has been under active attack since at least July 2026, and on 9 September CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 12 September. The flaw, tracked as CVE-2025-25249, was patched quietly back in January 2026 under advisory FG-IR-25-084. What changed is the evidence of exploitation: SOCRadar's Threat Research Unit published an analysis on 8 September that ties the vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. to a bespoke post-exploitation toolkit its researchers call PivotC2.

The bug lives in `cw_acd`, the daemon that speaks CAPWAP to managed FortiAP wireless access points. A remote, unauthenticated attacker who can reach the CAPWAP control port sends crafted packets that corrupt heap memory and ultimately run code in the context of the daemon. There is no login step and no user interaction. That combination, on a device that sits at the network edge, is why CISA gave federal agencies three days rather than the usual weeks.

Sources disagree on severity. The National Vulnerability Database scores it 9.8 critical with an AV:N/AC:L vector. Fortinet's own CNA record rates it 8.1 high, arguing higher attack complexity (AC:H). Several trackers reproduced a 7.3 or 7.4 figure. The operational read does not change with the number: the flaw is remotely reachable, needs no authentication, and is being exploited today.

Who Is Affected

FG-IR-25-084 covers a wide swath of the FortiOS line. Vulnerable trains are FortiOS 6.4.0 through 6.4.16, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. FortiSwitchManager 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6 are also affected, as are the FortiSASE 25.1.a and 25.2.b cloud releases, which Fortinet patches on its own schedule.

Fixed builds are FortiOS 6.4.17, 7.0.18, 7.2.12, 7.4.9, and 7.6.4, and FortiSwitchManager 7.0.6 and 7.2.7. The exposure hinges on configuration. The `cw_acd` daemon answers CAPWAP control traffic on interfaces where the Security Fabric Connection service is permitted in `allowaccess`. Since FortiOS 6.4 that single `fabric` keyword bundles FortiTelemetry and CAPWAP, so an interface enabled for fabric management is also listening for CAPWAP whether or not you run FortiAPs on it. Any such interface reachable from the internet is a candidate.

How the Attack Works

SOCRadar's reconstruction shows a disciplined chain rather than a smash-and-grab. The initial exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. ships as a self-extracting Linux binary the actors named `fortirun.bin`, which unpacks a Python runtime and helper modules. It first defeats address space layout randomization by reading memory pointers leaked in CAPWAP discovery responses, then grooms the heap with a sequence of crafted control messages so that a final oversized "Image Data" message overwrites an adjacent free-list structure. From that write primitive the exploit builds a return-oriented programming chain and pivots execution into a Node.js reverse shellReverse Shell🛡️A remote-access technique where a compromised host initiates an outbound connection back to the attacker and hands over a command shell. Because the connection originates inside the network, it often slips past firewalls that block inbound traffic..

That shell pulls down PivotC2, a Node.js implant SOCRadar tracks at version 0.2.3. It writes a stager to `/tmp/.i.js`, decodes it with a trivial XOR key, and runs as a detached background process. Command and control rides a single persistent TLS connection using a custom binary framing protocol with channel multiplexing and heartbeats, which lets one connection carry shells, file transfers, SOCKS5 and HTTP proxying, port forwardingPort Forwarding🌐Directing incoming traffic on specific ports to a particular device on your network., and network scans. The mechanics of turning that memory corruption into a running process are the subject of our companion explainer, How a Heap OverflowHeap Overflow🛡️A memory-corruption bug where a program writes more data into a heap allocation than it was sized to hold, spilling into adjacent memory. When the overwritten neighbor is the allocator's own bookkeeping, an attacker can steer it toward code execution. in a Network Daemon Becomes Code Execution.

The Credential Problem

PivotC2 is built specifically to strip a FortiGate of its secrets. It reads the device's compressed configuration files, locates the encrypted credential blobs, and decrypts them using both a hardcoded AES-256-CBC key and an AES-128-GCM key derived from the appliance's own key file. The result is plaintext VPN pre-shared keys, SSL-VPN user credentials, wireless passwords, LDAP bind secrets, and administrator accounts. In two confirmed intrusions against US organizations, SOCRadar traced the operators from harvested firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. credentials into full network compromise, including remote-desktop abuse, browser credential theft, and exfiltration of Microsoft Exchange mailbox data to cloud storage.

That is why patching alone is not enough. Anything the box held should be considered exposed, a point we develop in After a Firewall Breach, Assume Every Stored Credential Is Compromised.

Immediate Actions

Patch to a fixed build first. Where you cannot patch immediately, apply Fortinet's workaround: remove `fabric` from `allowaccess` on any interface that does not need it, or add a local-in policy that blocks CAPWAP-CONTROL on UDP ports 5246 through 5249 from untrusted sources. Reducing what the appliance exposes to the internet is a broader discipline covered in How to Find and Restrict the Services Your Firewall Exposes.

Then hunt. SOCRadar's indicators include the C2 addresses 46.151.29.58 and 146.103.99.177, and the on-device artifact `/tmp/.i.js`. From the FortiOS shell you can list active sessions to those addresses and check for the stager file and unexpected Node.js processes. Because the KEV clock is short, pair this with the process in How to Triage a CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines. Addition in 72 Hours. If you find artifacts, rotate every stored credential and follow a structured rebuild rather than a hopeful reboot, as in How to Rebuild a Compromised VPN Appliance.

Long-Term Outlook

Two things make this campaign notable beyond the CVE. First, the actors weaponized a bug that had been patched for six months, a reminder that a fix in the release notes is not a fix on the device. Second, SOCRadar assessed with the code comments and operational guidance it recovered that the operators likely used AI tooling to accelerate building the RAT and its intrusion workflow. The tradecraft still points to a Russian-speaking, financially motivated crew, distinct from the earlier FortiBleed activity. But the productivity signal is worth watching: the gap between a public patch and a polished, mass-scale exploitation kit is getting shorter, and edge appliances remain the front door.

Sources

• CISA, Known Exploited Vulnerabilities Catalog (feed, catalog version 2026.09.10): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, "CISA Adds Four Known Exploited Vulnerabilities to Catalog," 9 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
• NVD, CVE-2025-25249: https://nvd.nist.gov/vuln/detail/CVE-2025-25249
• Fortinet PSIRT, FG-IR-25-084: https://www.fortiguard.com/psirt/FG-IR-25-084
• SOCRadar, "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT," 8 September 2026: https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
• SecurityWeek, "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks": https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/