Published: Thu 10 Sept 2026
Prepared by: Adam Skupien, Vulnerability Security Analyst
Summary
Active exploitation of CVE-2025-25249 has been confirmed against Fortinet FortiOS and FortiSwitchManager, allowing an unauthenticated attacker to achieve remote code execution and deploy persistent malware. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 9 September 2026, with a remediation deadline of 12 September 2026.
The fix is not new, patched firmware has been available since August 2025 - five months before Fortinet's public disclosure in January 2026, and over a year before this campaign came to light. Any organisation still exposed has had a fix available for close to twelve months. Whether a compromise check is also warranted depends on timing: July 2026 is the earliest date SOCRadar could confirm exploitation was occurring, not necessarily when it began. An environment patched well before then carries substantially lower risk of prior compromise; one that was still vulnerable at any point from July 2026 onward should be treated as a suspected compromise, not just an overdue patch.
Vulnerability details
-
- Severity: High (Fortinet: Common Vulnerability Scoring System (CVSS) 7.3-7.4) / Critical (National Vulnerability Database (NVD): CVSS 9.8)
- Exploit status: Confirmed active exploitation since at least July 2026, identified by SOCRadar's Threat Research Unit. Over 30,000 FortiGate IPs targeted, 178 confirmed infections, including two full network intrusions with confirmed data exfiltration.
- Patch status: Fixed builds shipped between August 2025 (FortiOS 7.6.4) and November 2025 (FortiOS 7.0.18), publicly disclosed by Fortinet as FG-IR-25-084 on 13 January 2026 - 5 to 9 months after fixes were already available.
- Vulnerability type: Heap-based buffer overflow (Common Weakness Enumeration (CWE)-122) in the cw_acd daemon, which processes Control and Provisioning of Wireless Access Points (CAPWAP) control traffic on User Datagram Protocol (UDP) port 5246.
- Impact: Unauthenticated, remote arbitrary code execution - no credentials or user interaction required.
- Mechanism (SOCRadar technical analysis): attacker leaks memory pointers via a CAPWAP Discovery Request to defeat Address Space Layout Randomization (ASLR), grooms the heap using crafted CAPWAP Add Station messages, then triggers the overflow via a weaponized CAPWAP Image Data message to hijack control flow and spawn a Node.js reverse shell.
Successful exploitation gives an unauthenticated remote attacker arbitrary code execution on the device, enabling:
- Full compromise of the FortiGate firewall or FortiSwitchManager platform.
- Deployment of PivotC2, a persistent Node.js Remote Access Trojan (RAT) with interactive shell, tunneling, and network-scanning capability.
- Theft and decryption of stored device secrets - Virtual Private Network (VPN) pre-shared keys (PSKs), SSL-VPN credentials, Lightweight Directory Access Protocol (LDAP) bind credentials, admin accounts.
- Use of the device as a pivot point for lateral movement into the internal network.
Mitigation actions
- Patch now - fixes have been available for up to a year (see table above). Upgrade to:
- FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18 (or later)
- FortiSwitchManager 7.2.7 or 7.0.6 (or later)
- FortiOS 6.4 devices must be upgraded to a supported release line - no fix will be issued for 6.4.
- Use the FortiGate Upgrade Tool to plan a safe path between releases.
- If immediate patching isn't possible: disable the "fabric" service on external or Wide Area Network (WAN) interfaces, or block inbound UDP 5246-5249 from untrusted networks. Short-term only - the device must still be patched.
- Given the length of exposure, treat this as a compromise assessment, not just a patch task - assume any unpatched, internet-facing device may already be affected and check for the indicators below before/alongside patching.
Detection capabilities
Indicators of compromise
- Outbound connections to
46.151.29[.]58or146.103.99[.]177. - Dropped payload at
/tmp/.i.js. - Unexpected
nodeprocesses (Node.js ships natively with FortiOS - correlate with network activity, don't rely on process name alone). - Command Line Interface (CLI) checks:
diagnose sys session filter daddr <IP>/diagnose sys session list;fnsysctl ls -la /tmp/.
If compromise is suspected
- Isolate the device immediately.
- Assume full configuration exfiltration - rotate all admin passwords, SSL-VPN credentials, LDAP bind secrets, wireless PSKs, and IPSec PSKs.
- Rebuild/re-image onto fixed firmware - patching does not remove an implant that is already running.
- Hunt internally for lateral movement (Remote Desktop Protocol (RDP) registry changes, reverse-SSH relays, browser credential theft, unusual outbound transfers).
MDR customers: Triskele Labs is actively tuning detections for behaviour consistent with exploitation of CVE-2025-25249 and PivotC2 activity across supported log sources.
Vulnerability Management customers: Environments are being assessed for vulnerable Fortinet versions and CAPWAP/fabric exposure; any exposure will be communicated through priority channels.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-084
- https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
- https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
- https://docs.fortinet.com/upgrade-tool/fortigate
- https://github.com/advisories/GHSA-mj8x-m8f5-x4w8
