Back Securityweek

Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks

Securityweek • September 10, 2026

Threat actors have been exploiting an unauthenticated remote code execution (RCE) vulnerability in Fortinet products to deploy a Node.js RAT, SOCRadar reports.

Tracked as CVE-2025-25249 (CVSS score of 7.4) and described as a heap-based buffer overflow issue, the high-severity bug was patched in January in FortiOS and FortiSwitchManager.

The flaw “may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,” Fortinet noted in its advisory .

This week, SOCRadar warned that hackers have been exploiting the security defect to deploy the PivotC2 RAT on vulnerable devices.

A FortiGate post-exploitation tool, the backdoor provides attackers with interactive shell access, traffic tunneling, network scanning, and configuration harvesting capabilities.

SOCRadar believes that PivotC2 was likely developed with the use of AI and that threat actors have been using it in attacks since at least July 2026.

“The threat actors targeted more than 30,000 IP addresses, leading to the exploitation and infection of 178 devices with PivotC2,” SOCRadar says.

The attacks mainly targeted US entities, where at least two intrusions have resulted in data exfiltration.

According to the cybersecurity firm, the attacks are likely mounted by a Russian-speaking cybercrime actor.

On Wednesday, the US cybersecurity agency CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities ( KEV ) catalog, urging federal agencies to patch it within three days, in line with BOD 26-04’s requirements.

Patches for the bug were rolled out in FortiOS versions 7.6.4, 7.4.9, 7.2.12, and 7.0.18, and in FortiSwitchManager versions 7.2.7 and 7.0.6. All organizations are advised to update to these or newer versions.

Related: Android’s September 2026 Updates Patch 180 Vulnerabilities

Related: Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories

Related: Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension

Related: ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet Vulnerability CVE-2025-25249 Exploited by PivotC2 RAT Threat actors are exploiting CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager, to deploy a Node.js remote access trojan (RAT) known as PivotC2. This vulnerability allows unauthenticated remote code execution, affecting numerous devices, including FortiGate appliances. Reports indicate that over 30,000 IP addresses have been targeted, resulting in the infection of at least 178 devices, primarily in the U.S. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities catalog, urging immediate patching. The vulnerability was patched by Fortinet in January 2026, but active exploitation has been confirmed as of September 2026. Organizations using affected versions are advised to upgrade to the latest releases to mitigate risks. 11 sources 73

Extracted Entities

Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (4)

Platforms (2)