Fortinet FortiOS
CVE-2025-25249
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed FortiOS/FortiSwitchManager
-
DeliverySend specially crafted packet
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionHijack execution in privileged daemon
-
PersistExecute unauthorized code/commands
-
ImpactDeploy RAT and persist
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected device must be network-reachable by the attacker on the vulnerable service that parses the crafted packets, and it must run an unpatched FortiOS (6.4-7.6.3 as listed) or FortiSwitchManager (7.0.0-7.0.5 / 7.2.0-7.2.6) build. Per CVSS AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, or user-interaction prerequisites - unauthenticated remote exploitation against a reachable vulnerable instance. The main limiting factor is exposure: devices with management/affected services restricted to trusted networks are far less exposed, and patched builds are not affected. |
| Impact | This is a top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated bug, and CISA KEV confirms real-world active exploitation with public POC - the strongest possible combination of signals. The one apparent conflict is EPSS at 0.01% (2nd percentile), which is unusually low for a KEV-listed flaw; this most plausibly reflects targeted, operator-driven exploitation of internet-exposed FortiGate devices rather than broad automated mass exploitation, and low EPSS should NOT be read as low risk here given the confirmed KEV status. Treat as an emergency-patch item for any internet-facing FortiOS/FortiSwitchManager deployment. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed FortiGate or FortiSwitchManager instance and sends a specially crafted packet that overflows a heap buffer in a network-facing service, corrupting heap memory to hijack execution and run commands with the daemon's privileges. With no authentication or user interaction needed and public exploit code available, this can be automated against exposed devices and, per threat reporting, used to deploy a persistent FortiGate RAT. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 09, 2026
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run unauthorized code or commands by sending specially crafted packets to an affected device. The flaw is a heap-based buffer overflow requiring no authentication or user interaction, and it is confirmed actively exploited (CISA KEV) with publicly available exploit code, reportedly tied to a 'PivotC2' FortiGate RAT. Despite the KEV listing, EPSS is only 0.01% (2nd percentile), indicating targeted rather than mass-scanning exploitation to date.
Earlier versions of this analysis (1)
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets [CVSS 8.1 HIGH]
RemediationAI
Apply the Fortinet fixed releases per advisory FG-IR-25-084 (https://fortiguard.fortinet.com/psirt/FG-IR-25-084), which identifies the exact patched builds for each FortiOS and FortiSwitchManager branch - upgrade beyond the listed vulnerable ranges (e.g. past 7.6.3, 7.4.8, 7.2.11, 7.0.17), and note that FortiOS 6.4 is end-of-support so migrate to a supported patched branch. Because exploitation is over the network via crafted packets, the primary compensating control while patching is to restrict reachability: remove management and administrative interfaces from the public internet, limit the affected services to trusted management networks or VPN, and apply local-in firewall policies to block untrusted sources - with the trade-off that overly broad blocks can break legitimate remote administration. Given confirmed active exploitation, also hunt for compromise (unexpected admin accounts, config changes, and the referenced RAT indicators from https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/) rather than assuming patching alone is sufficient.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Fortinet's FortiOS network operating system (running FortiGate firewalls/appliances) and FortiSwitchManager, with CPE data also naming FortiSASE builds 25.1.39 and 25.1.51. The root cause is CWE-122 (heap-based buffer overflow): a network-facing parser processes attacker-supplied packet data into an undersized heap allocation, corrupting adjacent heap metadata or objects. On embedded network appliances such as these, successful heap grooming and overflow typically yields code execution in a privileged daemon context, which is why CVSS rates confidentiality, integrity, and availability all High.
Know when Fortios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable crafted packets yield code execution with no user interaction, giving full confidentiality, integrity, and availability impact (AV:N/AC:L/PR:N/UI:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
Executive ViewAI
Fortinet FortiOS versions 6.4 through 7.6.3 and FortiSwitchManager 7.0.x/7.2.x contain a critical unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary commands on affected network gateways and switches. The vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, creating immediate risk to organizations' network perimeter defenses. No vendor patch is currently available, requiring emergency mitigation measures to prevent full firewall compromise and lateral network access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation to isolate affected FortiOS/FortiSwitchManager instances from direct internet exposure; (2) Deploy IDS/IPS signatures targeting CVE-2025-25249 exploitation traffic on network perimeter; (3) Restrict administrative interface access via IP whitelisting from authorized administrative networks only; (4) Enable comprehensive logging and enable continuous log monitoring for indicators of compromise including unexpected command execution; (5) Conduct threat hunting for PivotC2 C2 beacons and post-exploitation artifacts in network traffic and logs; (6) If equipment replacement is infeasible within acceptable risk window, temporarily air-gap internet-facing affected devices while maintaining internal accessibility for critical operations.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)NVD
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated admi
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
GitHub PoC
Exploit-DB