Skip to content
Fortinet Vulnerability CVE-2025-25249 Exploited by PivotC2 RAT

Fortinet Vulnerability CVE-2025-25249 Exploited by PivotC2 RAT

First seen 9 Sep 2026, 13:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 10, 2026 at 12:46 UTC
  • •CVE-2025-25249 allows unauthenticated remote code execution on Fortinet devices.
  • •The PivotC2 RAT has infected at least 178 devices, primarily targeting U.S. entities.
  • •CISA has listed this vulnerability as actively exploited, urging immediate patching.

Threat actors are exploiting CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager, to deploy a Node.js remote access trojan (RAT) known as PivotC2. This vulnerability allows unauthenticated remote code execution, affecting numerous devices, including FortiGate appliances. Reports indicate that over 30,000 IP addresses have been targeted, resulting in the infection of at least 178 devices, primarily in the U.S. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities catalog, urging immediate patching. The vulnerability was patched by Fortinet in January 2026, but active exploitation has been confirmed as of September 2026. Organizations using affected versions are advised to upgrade to the latest releases to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 44d ago How this analysis works

Timeline

2026-01-13
CVE-2025-25249 published
Fortinet disclosed a heap-based buffer overflow vulnerability affecting FortiOS and FortiSwitchManager.
Securityweek
2026-08-25
CVE-2026-19949 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-01
CVE-2026-83549 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-01
CVE-2026-83548 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-08
CVE added to CISA KEV
CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog, highlighting active exploitation.
Securityweek
2026-09-09
Reports of active exploitation
SOCRadar confirmed that attackers are exploiting the vulnerability to deploy the PivotC2 RAT on vulnerable devices.
Linkedin
2026-09-10
CISA urges patching
CISA urged federal agencies to patch CVE-2025-25249 within three days due to confirmed exploitation.
Securityweek

More articles in this cluster (13)

Following this threat?

Track PivotC2 RAT and CVE-2025-25249 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4