CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devices
CVE-2025-25249 (TL-2026-2431) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-10. It is linked to a Russia-nexus actor with high confidence, affects Fortinet FortiOS, references 1 CVE (CVE-2025-25249), maps to 21 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-2431
- Threat ID
- TL-2026-2431
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-10
- Last reviewed
- 2026-09-10
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target regions
- united states of america, chile, colombia, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-09-10 · revalidated 1× · latest source
Malware and tooling in CVE-2025-25249
Malware and tooling: PivotC2, PivotC2 binary framing protocol, fortirun.bin
A Russian-speaking, financially motivated cybercrime group is mass-exploiting CVE-2025-25249, an unauthenticated heap-based buffer overflow in the cw_acd/CAPWAP daemon of FortiOS, FortiSwitchManager, and FortiSASE, to deploy PivotC2, a custom Node.js post-exploitation RAT built specifically for FortiGate appliances. The campaign has scanned 30,000+ IPs, infected at least 178 devices (mostly in the US), and produced at least two full-network intrusions with Microsoft Exchange mailbox exfiltration to Wasabi cloud storage.
How CVE-2025-25249 works
CVE-2025-25249 is a heap-based buffer overflow (CWE-787/CWE-122) in the cw_acd daemon that services the CAPWAP Control protocol on UDP/5246 in FortiOS, FortiSwitchManager, and FortiSASE. NVD and Tenable independently score the flaw CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical) for the unauthenticated, single-packet remote code execution path; Fortinet's own vendor advisory reportedly assigns a lower score (~7.3-7.4) under a higher access-complexity assumption, but the exploitation observed in the wild — a single crafted CAPWAP packet triggering RCE with no prerequisites — matches the higher NVD/Tenable score. Fortinet patched the issue in January 2026 (FortiOS 7.6.4/7.4.9/7.2.12/7.0.18/6.4.17, FortiSwitchManager 7.2.7/7.0.6) via PSIRT advisory FG-IR-25-084, but active in-the-wild exploitation was confirmed no later than July 2026, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-09 with a 3-day BOD 26-04 federal remediation deadline of 2026-09-12.
The observed exploit chain uses a self-extracting Linux binary, fortirun.bin, driven by Bash/Python automation that repeatedly targets candidate IPs. Per SOCRadar and corroborating outlets, the binary fingerprints target firmware/hardware, abuses CAPWAP discovery responses to defeat ASLR, corrupts heap linked-list pointers to gain an arbitrary-write primitive, and hijacks execution to spawn a Node.js reverse shell. The reverse shell executes a single-line JavaScript stager that fetches a second-stage payload from an attacker-controlled server (observed at 146.103.99.177:8443/0c5b76709523), Base64-decodes it, and XOR-decrypts it with the key "pivot" before writing the final implant to /tmp/.i.js and launching it as a detached background process.
The deployed implant, PivotC2 (v0.2.3), is a purpose-built Node.js post-exploitation framework for FortiGate appliances. It opens outbound TLS connections to its C2 (sidestepping inbound firewall restrictions) using a compact binary framing protocol that multiplexes multiple SSH-like channels over a single connection. Capabilities include an interactive shell, file upload/download, SOCKS5/HTTP proxying, local and remote port forwarding, CIDR-based network/port scanning, and FortiGate-specific configuration harvesting — including automatic AES-256-CBC/AES-128-GCM decryption of Fortinet's encrypted (ENC) credential fields inside config-sync artifacts such as fsv_sync.dat, yielding plaintext VPN pre-shared keys, SSL-VPN credentials, wireless PSKs, LDAP bind secrets, and administrator accounts. An "--auto" mode chains a five-stage pipeline (config harvest → credential decrypt → subnet extraction → port scan → reporting) with no operator interaction required per newly infected device.
Operators scanned more than 30,000 internet-exposed FortiGate/FortiSwitchManager IPs and successfully compromised at least 178 devices, concentrated in the United States with additional infections in Chile, Colombia, and the United Kingdom. At least two confirmed intrusions against US-based organizations progressed to full network compromise, involving Active Directory enumeration, browser credential theft, RDP enablement/abuse, reverse SSH relays, and exfiltration of Microsoft Exchange mailbox (.pst) data to Wasabi S3-compatible cloud storage. Russian-language code comments, unusually detailed inline documentation/usage guidance suggestive of AI-assisted development, and financially-motivated exfiltration patterns (targeting backup/mailbox data rather than sabotage) support a high-confidence assessment of a Russian-speaking, financially driven cybercrime operator rather than a state-directed APT. A BeaconBeagle lookup on both observed C2 IPs (146.103.99.177, 46.151.29.58) returned no prior corpus matches, indicating newly stood-up or previously unindexed infrastructure.
MITRE ATT&CK techniques used in TL-2026-2431
Collection
T1005 Data from Local System; T1114.002 Email Collection
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1087.002 Account Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071.001 Application Layer Protocol; T1090 Proxy; T1572 Protocol Tunneling; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
Affected products and versions in CVE-2025-25249
- Fortinet — FortiOS
Vulnerable versions: 6.4.0-6.4.16; 7.0.0-7.0.17; 7.2.0-7.2.11; 7.4.0-7.4.8; 7.6.0-7.6.3
Fixed in: 6.4.17; 7.0.18; 7.2.12; 7.4.9; 7.6.4 - Fortinet — FortiSwitchManager
Vulnerable versions: 7.0.0-7.0.5; 7.2.0-7.2.6
Fixed in: 7.0.6; 7.2.7 - Fortinet — FortiSASE
Vulnerable versions: 25.1.39-25.1.51
Fixed in: 25.2.c
Remediation for CVE-2025-25249
Patches
- FortiOS 7.6.4
- FortiOS 7.4.9
- FortiOS 7.2.12
- FortiOS 7.0.18
- FortiOS 6.4.17
- FortiSwitchManager 7.2.7
- FortiSwitchManager 7.0.6
- FortiSASE 25.2.c
Immediate actions
- Apply Fortinet's January 2026 patches to every internet-exposed FortiOS, FortiSwitchManager, and FortiSASE instance
- Restrict or disable the CAPWAP Control service (UDP/5246-5249) on WAN-facing interfaces
- Hunt for fortirun.bin, /tmp/.i.js, unexpected Node.js processes, and outbound TLS sessions to 146.103.99.177 or 46.151.29.58 on FortiGate appliances
- Block outbound network traffic to 146.103.99.177 and 46.151.29.58 at the perimeter
Workarounds
- Disable Fabric/CAPWAP services on internet-facing interfaces where immediate patching is not possible
- Restrict CAPWAP UDP 5246-5249 to trusted management-network sources only
Longer-term hardening
- Rotate all locally stored FortiGate credentials (SSL-VPN, IPSec pre-shared keys, LDAP bind secrets, wireless PSKs, administrator accounts) on any device with suspected compromise, since PivotC2 decrypts Fortinet's ENC-format secrets automatically
- Deploy network segmentation so CAPWAP/Fabric management interfaces are never reachable from the internet
- Monitor for anomalous outbound TLS sessions and cloud-object-storage exfiltration destinations (e.g., Wasabi) originating from network security appliances
- Audit for downstream lateral movement indicators (RDP enablement, reverse SSH relays, Active Directory enumeration, browser credential theft) on any network segment reachable from a compromised FortiGate
CVEs associated with CVE-2025-25249
Weaknesses (CWE) in CVE-2025-25249
CWE-787, CWE-122
Timeline of CVE-2025-25249
- Fortinet ships the first fix for CVE-2025-25249 in FortiOS 7.6.4, predating the January 2026 public PSIRT disclosure; fixes for other branches follow through November 2025.
- Fortinet publishes PSIRT advisory FG-IR-25-084 and ships patched builds (FortiOS 7.6.4/7.4.9/7.2.12/7.0.18/6.4.17, FortiSwitchManager 7.2.7/7.0.6) fixing CVE-2025-25249.
- Active in-the-wild exploitation of CVE-2025-25249 begins (confirmed active no later than July 2026), with operators deploying the fortirun.bin exploit binary at scale against internet-exposed FortiGate and FortiSwitchManager devices.
- SOCRadar confirms at least two full-network intrusions against US-based organizations involving Active Directory enumeration, browser credential theft, RDP abuse, and exfiltration of Microsoft Exchange mailbox data to Wasabi cloud storage.
- SOCRadar's Threat Research Unit publishes the first detailed technical analysis of the campaign, naming the deployed implant PivotC2 and documenting its Node.js post-exploitation capabilities.
- CISA adds CVE-2025-25249 to the Known Exploited Vulnerabilities catalog as the 'Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability,' triggering BOD 26-04 federal remediation timelines.
- QuoIntelligence's Weekly Intelligence Snapshot (Week 37 2026) independently flags active exploitation of CVE-2025-25249 compromising FortiGate firewalls across multiple countries.
- SecurityWeek and other outlets (CybersecurityNews, GBHackers, CyberPress, Cypro) report broadly on the active PivotC2 campaign, citing 30,000+ scanned IPs and 178 confirmed infections.
- CISA BOD 26-04 due date for US federal civilian executive branch agencies to apply mitigations for CVE-2025-25249.
Update history for TL-2026-2431
- 2026-09-10 — Active Exploitation of CVE-2025-25249 Compromises FortiGate Firewalls Across Multiple Countries: What changed No field escalations: severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (9.8), and attribution_confidence (HIGH) are unchanged. The new report adds exploit-chain technical detail (ASLR bypass via a CAPWAP Disc
Sources cited for CVE-2025-25249
- Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
- CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
- NVD - CVE-2025-25249 Detail
- CISA Known Exploited Vulnerabilities Catalog
- Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware
- Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
- Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal Credentials
- FortiGate Malware Exploits Critical Firewall Flaw
- Tenable - CVE-2025-25249
- FortiOS and FortiSwitchManager Code Execution Vulnerability (CVE-2025-25249)
- Fortinet PSIRT FG-IR-25-084
More in vulnerability
- GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE
- Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)
- Tesla Wall Connector Gen 3: Anti-Downgrade (Security Ratchet) Bypass via Charge Port Connector
- Zero-click Pixel 10 exploit chain: VPU driver mmap flaw (CVE-2026-0106) enables arbitrary kernel read/write, chained with Dolby decoder RCE (CVE-2025-54957)
Detection coverage for TL-2026-2431
As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2431 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.