Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CVSS 8.1 heap overflow in FortiOS, FortiSwitchManager, and FortiSASE allows code execution via crafted packets. Actively exploited in PivotC2 RAT attacks; patched January 2026.
- Vendor
- Fortinet
- Product
- FortiOS, FortiSwitchManager, FortiSASE
- CVSS
- 8.1
- EPSS (exploit probability)
- 3.7%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-25249 being exploited?
Yes. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.7% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-27. Full cross-catalog view: /kev-comparison
CVE-2025-25249 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets, per NVD. SecurityWeek characterizes the attack vector as unauthenticated.
Fortinet patched CVE-2025-25249 in January 2026. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 9, 2026, confirming active exploitation in the wild. Threat actors are using the vulnerability to deploy a remote access trojan called PivotC2, according to SecurityWeek.
Under CISA’s BOD 26-04, federal civilian agencies must apply mitigations by September 12, 2026. Check the NVD record above for specific fixed versions and the Fortinet PSIRT advisory linked there for upgrade guidance.
Other Fortinet CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-107656 FortiSandbox Auth Bypass via Alternate Path Channelwrite-up | [ CRITICAL ] | 9.8 | — | — |
| CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability | [ MEDIUM ] | 6.0 | 1.3% | |
| CVE-2026-106173 Fortinet FortiSIEM and FortiSandbox GUI Unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 1.0% | — |
| CVE-2026-104286 Fortinet FortiMail Path Traversal and NULL Byte Flawwrite-up | [ CRITICAL ] | 9.8 | 4.6% | |
| CVE-2026-70468 FortiManager Authentication Bypass via Alternate Pathwrite-up | [ HIGH ] | 8.1 | 0.5% | — |
| CVE-2026-26035 FortiWeb Authentication Bypass Allows Unauthenticated Loginwrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2025-68686 FortiOS patch bypass re-enables symbolic link persistence on compromised deviceswrite-up | [ MEDIUM ] | 5.9 | 29.5% | |
| CVE-2026-39808 Fortinet FortiSandbox unauthenticated OS command injection (4.4 branch and PaaS)write-up | [ CRITICAL ] | 9.8 | 93.2% |
