What’s Vulnerable › Vulnerabilities

CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-09-09
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-13 · updated 2026-10-07
• Weakness: CWE-122

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Summary

CVE-2025-25249 is a critical (CVSS 9.8) heap-based buffer overflow in Fortinet FortiOS and FortiSwitchManager that lets an attacker execute unauthorized code or commands via specially crafted packets. It affects FortiOS 6.4 (all versions), 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8 and 7.6.0-7.6.3, plus FortiSwitchManager 7.0.0-7.0.5 and 7.2.0-7.2.6; FortiSASE and Siemens Ruggedcom Ape1808 firmware are also listed. The flaw is in CISA's Known Exploited Vulnerabilities catalog with active exploitation and a public exploit or detection template exists. Upgrade to FortiOS 7.0.18, 7.2.12, 7.4.9 or 7.6.4, or FortiSwitchManager 7.0.6 or 7.2.7, and apply vendor mitigations per CISA BOD 26-04 guidance.

تُعدّ CVE-2025-25249 ثغرة تجاوز سعة المخزن المؤقت في الكومة (heap-based buffer overflow) خطيرة بتقييم CVSS 9.8 في منتجات Fortinet FortiOS وFortiSwitchManager، وتتيح للمهاجم تنفيذ تعليمات برمجية أو أوامر غير مصرّح بها عبر حزم مُصمَّمة خصيصًا. تشمل الإصدارات المتأثرة FortiOS 6.4 بجميع إصداراته، و7.0.0 حتى 7.0.17، و7.2.0 حتى 7.2.11، و7.4.0 حتى 7.4.8، و7.6.0 حتى 7.6.3، إضافة إلى FortiSwitchManager 7.0.0 حتى 7.0.5 و7.2.0 حتى 7.2.6، كما تظهر FortiSASE وبرنامج Siemens Ruggedcom Ape1808 ضمن المنتجات المتأثرة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، ويتوفر استغلال عام أو قالب كشف. يُنصح بالترقية إلى FortiOS 7.0.18 أو 7.2.12 أو 7.4.9 أو 7.6.4، وإلى FortiSwitchManager 7.0.6 أو 7.2.7، وتطبيق تخفيفات المورّد وفق إرشادات CISA BOD 26-04.

Affected products

• Fortinet FortiOS (FortiGate): from 6.4.0 before 7.0.18; from 7.2.0 before 7.2.12; from 7.4.0 before 7.4.9; from 7.6.0 before 7.6.4 — fixed in 7.0.18, 7.2.12, 7.4.9, 7.6.4
• Fortinet FortiSASE: 25.1.39, 25.1.51
• Fortinet FortiSwitchManager: from 7.0.0 before 7.0.6; from 7.2.0 before 7.2.7 — fixed in 7.0.6, 7.2.7
• Siemens Ruggedcom Ape1808 Firmware: all versions

How to fix

Upgrade to a fixed version: Fortinet FortiOS (FortiGate) 7.0.18, 7.2.12, 7.4.9, 7.6.4; Fortinet FortiSwitchManager 7.0.6, 7.2.7. Check the vendor advisory for mitigations.

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-084
• https://cert-portal.siemens.com/productcert/html/ssa-864900.html
• https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249

Get alerted when CVE-2025-25249 or the next vulnerability affects your stack