Frequency
3
occurrences
First Seen
January 14, 2026
Last Seen
September 9, 2026
Related Threat Clusters
-
Active Exploitation of FortiGate Vulnerability with Node.js Malware
Threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow vulnerability in FortiGate firewalls, to deploy a custom Node.js malware framework called PivotC2. This framework allows…
2 articles · Updated September 9, 2026 -
FortiOS and FortiSwitchManager Vulnerability Enables Remote Code Execution
Fortinet disclosed a critical heap-based buffer overflow vulnerability in the cw_acd daemon of FortiOS and FortiSwitchManager, tracked as CVE-2025-25249. This flaw allows remote unauthenticated attackers to execute…
3 articles · Updated January 14, 2026
Recent Intelligence Reports
- Hackers Exploit FortiGate Vulnerability to Deploy Custom Node.js Remote — Linkedin · September 9, 2026
- Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware — Cybersecuritynews · September 8, 2026
- FortiOS and FortiSwitchManager Flaw Allows Remote Code Execution — Gbhackers · January 14, 2026