Act nowKnown exploited

Advisory · CVE-2025-25249

Fortinet firewalls hit by heap-overflow bug dropping PivotC2

A heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE lets an attacker execute code via crafted packets. SOCRadar links in-the-wild exploitation to the PivotC2 malware campaign; CISA confirms active exploitation.

Advisory published September 9, 2026Independent summary
Vendor
Fortinet
Product
FortiOS
Identifier / CWE
CVE-2025-25249
CWE-122, CWE-787
Action timing
Sep 30, 2026
ELI5

Explain it like I’m five

A security guard's radio has a button sequence that makes the guard follow any shouted order. A stranger across the street can shout the right sequence through the air and take over the guard post without ever touching the gate.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted packets

    A remote attacker sends specially crafted packets to an internet-reachable Fortinet device.

  2. 02Heap overflow

    The packets trigger a heap-based buffer overflow in the device's packet-handling code.

  3. 03Code executes

    The memory corruption lets the attacker execute unauthorized code or commands on the device.

  4. 04PivotC2 installed

    In observed attacks, the foothold is used to install the PivotC2 remote access malware for persistent control.

What happened

Fortinet PSIRT advisory FG-IR-25-084 documents a heap-based buffer overflow (CWE-122, also tracked as CWE-787) in FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands via specially crafted packets. NVD rates it CVSS 3.1 9.8; Fortinet’s own assessment is 8.1. Affected versions include FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, all of 6.4, and FortiSwitchManager 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5. Fortinet released patches in January 2026. SOCRadar reported real-world exploitation beginning in July 2026, with attackers targeting more than 30,000 IP addresses and infecting 178 devices with PivotC2, a Node.js-based remote access trojan providing interactive shells, tunneling, internal network scanning, and configuration harvesting. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 9, 2026.

What to do

  1. Upgrade FortiOS to 7.6.4, 7.4.9, 7.2.12, 7.0.18, or 6.4.17 depending on branch, FortiSwitchManager to 7.2.7 or 7.0.6, and remediate FortiSASE per FG-IR-25-084.
  2. Inspect every internet-exposed Fortinet device for signs of PivotC2 or abnormal connections, and review configurations and logs for unauthorized changes.
  3. If patching is delayed, follow Fortinet’s mitigation guidance: remove fabric access from interfaces or use a local-in policy to block the affected daemon’s ports.
  4. Treat devices showing post-exploitation indicators as compromised: isolate, preserve evidence, rebuild, and rotate credentials stored on or reachable from the device.

Management note

This is a remotely triggerable flaw in the firewall itself, and attackers have already used it to turn FortiGate devices into persistent beachheads with a full-featured RAT. Firewalls are the perimeter, so a compromise here hands the attacker the vantage point they need for everything behind it. CISA’s listing confirms active exploitation, and patching plus device inspection should happen together, not as separate phases.