CVE-2025-25249: fortinet fortios, fortinet fortiswitchmanager, fortinet fortisase

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-09-09 · published 2026-01-13

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Affected products (NVD): fortinet fortios, fortinet fortiswitchmanager, fortinet fortisase, siemens ruggedcom_ape1808_firmware

Fixed in (NVD): 7.0.18, 7.2.12, 7.4.9, 7.6.4, 7.0.6, 7.2.7

Weakness: CWE-122, CWE-787

Source: NVD CVE-2025-25249

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-084
• https://cert-portal.siemens.com/productcert/html/ssa-864900.html
• https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.