DaystoPatch

FortinetExploited incident

FortiOS and FortiSwitchManager cw_acd (CAPWAP) heap overflow allowing unauthenticated RCE

CVE-2025-25249High, CVSS 8.1In CISA's Known Exploited Vulnerabilities catalog since 9 Sep 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statementUnverified source
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date onlyUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-084CuratedQuote not checked yet

    2026-01-13: Initial publication

    Internally discovered; the advisory is the first public signal. Exploitation (PivotC2 campaign, per SOCRadar) was reported in September 2026, from activity since at least July 2026.

    Source
    Fortinet PSIRT FG-IR-25-084 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-25249ClaimedQuote verified13 Jan 2026, 16:32 UTC

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:252b49c1af744fe9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 Jan 2026, 17:24 UTC

    🟠 CVE-2025-25249 - High (8.1)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet8 Sep 2026, 17:20 UTC

    CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT # CVE_2025_25249 # PivotC2 https:// socradar.io/blog/cve-2025-2524 9-pivotc2-fortigate-rat/

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-25249)ClaimedQuote verified9 Sep 2026

    Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2026-09-09.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-084CuratedQuote not checked yet

    2026-01-13: Initial publication

    Source
    Fortinet PSIRT FG-IR-25-084 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Fortinet PSIRT FG-IR-25-084 (Wayback snapshot 2026-01-13 17:18 UTC)CuratedQuote verified

    For each interface, remove "fabric" access.

    Workaround (remove 'fabric' allowaccess, or block CAPWAP-CONTROL UDP 5246-5249 with a local-in policy) present in the snapshot taken on the publication day.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:338c5fb341c93f94…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Fortinet PSIRT FG-IR-25-647 (Wayback snapshot 2025-12-10 01:17 UTC; lists the same FortiOS builds as fixes)CuratedQuote verified

    Upgrade to 7.6.4 or above

    R2: FortiOS 7.6.4 (the 7.6 fix for CVE-2025-25249) was already the recommended upgrade in this earlier advisory (initial publication 2025-12-09). Upper bound: Triskele Labs says 7.6.4 shipped in August 2025 (not verified).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ddda3269ee16b14d…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-084CuratedQuote verified13 Jan 2026

    Upgrade to 7.6.4 or above

    Fixed builds predate the advisory (silent fix; Triskele Labs says FortiOS 7.6.4 shipped in August 2025 and 7.0.18 in November 2025). Those release dates were not verified, so the advisory date is used; since world is also the advisory date, exposure is zero either way.

    Source
    Fortinet PSIRT FG-IR-25-084 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c1fe011954ebfd95…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-25-647 (Wayback snapshot 2025-12-10 01:17 UTC)CuratedQuote verified

    Upgrade to 7.0.18 or above

    R2/R6: FG-IR-25-647 (2025-12-09) already lists FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 and FortiSwitchManager 7.2.7 / 7.0.6, i.e. every fixed version FG-IR-25-084 later names, so all lines were fixed by then (upper bound).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ddda3269ee16b14d…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-084CuratedQuote verified13 Jan 2026

    Upgrade to 7.0.18 or above

    Every branch with a fixed version (FortiOS 7.6/7.4/7.2/7.0, FortiSwitchManager 7.2/7.0) had one when the advisory was published. FortiOS 6.4 is 'Migrate to a fixed release' (6.4.17 was initially listed as fixed and removed on 2026-02-23) and is not counted.

    Source
    Fortinet PSIRT FG-IR-25-084 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c1fe011954ebfd95…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiOS
  • FortiSwitchManager
How we built this timeline

Coordinated/internal disclosure: Fortinet published fixes on 13 Jan 2026 with 'Known Exploited: No' (still No on the live page fetched 22 Oct 2026, even after the KEV listing). SOCRadar reported exploitation delivering the PivotC2 Node.js RAT (activity since at least July 2026);

KEV 9 Sep 2026. Severity: Fortinet CVSSv3 8.1 (High);

NVD reportedly 9.8. Timeline edits: 19 Jan 2026 added details about ASLR/PIE security controls; 23 Feb 2026 removed FortiOS 6.4.17 from the fixed versions.

The earliest Wayback snapshot (20260113171838) shows the workaround already present, FortiOS 6.4 listed as 'Upgrade to upcoming 6.4.17 or above' (removed 23 Feb 2026) and FortiSASE rows (25.2.b remediated by Fortinet in 25.2.c; 25.1.a migrate) that the live page no longer shows. Requires the 'fabric' service to be enabled on a reachable interface.

Related

Fortinet report card