FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited

What to do

1. Inventory every FortiGate, FortiSwitchManager, FortiProxy and FortiPAM with its version (get system status).
2. Upgrade FortiOS to 7.4.10+ or 7.6.5+, which covers both CVEs; move 7.2, 7.0 and 6.4 units to a fixed branch.
3. Until patched, remove the fabric service from internet-facing interfaces and block UDP 5246-5249 from untrusted networks with a local-in policy.
4. Hunt for PivotC2 and PEERSTITCH indicators before and after patching; an upgrade does not remove an implant.
5. If you find indicators, rebuild the device from known-good firmware and config, and rotate admin, SSL-VPN, LDAP, wireless and IPsec secrets.
6. Require MFA and unique credentials for FortiGate admins, and keep FortiManager and management interfaces off the internet.

How to check if you are affected or compromised

• Check for the PivotC2 stager with fnsysctl ls -la /tmp/ (look for .i.js) and for sessions to 46.151.29.58 or 146.103.99.177 using diagnose sys session filter daddr <IP> then diagnose sys session list.
• Search the configuration for auto-script objects whose names contain ../, such as ../../../../setup, which Unit 42 tied to PEERSTITCH.
• Run diagnose debug crashlog read and look for Signal 11 crashes in miglogd, iked or syslogd.
• Review admin logins and config changes for unfamiliar sources, especially on FortiGates managed by a FortiManager that was exposed to CVE-2024-47575.

What happened#

Two FortiOS flaws disclosed earlier in 2026 have been added to CISA's Known Exploited Vulnerabilities catalog. One is serious on its own. The other is dangerous for anyone whose admin credentials have leaked.

CVE-2025-25249 (FG-IR-25-084, published January 13, 2026) is a heap-based buffer overflow in cw_acd, the CAPWAP daemon in FortiOS and FortiSwitchManager. A remote, unauthenticated attacker can send crafted requests to execute code. Fortinet found it internally and scores it CVSS 3.1 8.1. It notes that ASLR and PIE make exploitation harder but do not prevent it. NVD scores it 9.8. Fortinet's advisory still says "Known Exploited: No." On September 8, SOCRadar reported exploitation since at least July 2026: more than 30,000 targeted IPs and 178 devices infected with PivotC2, a Node.js remote access trojan that harvests FortiGate configurations and decrypts stored secrets. It also confirmed two U.S. intrusions with data exfiltration. SOCRadar attributes the activity to a Russian-speaking, financially motivated operator. CISA added the CVE the next day, in its September 9 alert.

CVE-2025-61624 (FG-IR-26-122, April 14, 2026) is a path traversal in the CLI of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. It lets a privileged user write or delete arbitrary files. The vendor rates it 6.0 (NVD: 6.5) and marked it "Known Exploited: Yes" from day one. On October 14, Unit 42 explained how. Attackers who breached a telecom MSP's FortiManager through CVE-2024-47575, starting in September 2024, took a configuration archive covering more than 500 managed FortiGates and brute-forced credentials from it. They then used an unsanitized auto-script name to run code as root and injected the PEERSTITCH implant into the miglogd and iked daemons. Unit 42 says the implant reached "a select number of firewalls," not all 500. CISA added the CVE on October 16.

Who is affected#

FortiOS 7.6.4 and 7.4.9 fix CVE-2025-25249. FortiOS 7.6.5 and 7.4.10 fix both bugs. FortiOS 7.2.12 and 7.0.18 fix only the CAPWAP flaw, and Fortinet tells 7.2, 7.0 and 6.4 users to migrate for CVE-2025-61624. Fortinet removed 6.4.17 from its fixed list in February, so no 6.4 build is fixed for CVE-2025-25249 either. FortiSwitchManager needs 7.2.8 or 7.0.7, FortiProxy 7.6.5 or 7.4.12, and FortiPAM 1.7.1 or 1.8. The CVE-2025-25249 and CVE-2025-61624 records say Fortinet fixed FortiSASE in the service itself, so customers need do nothing. Fortinet's workaround for the CAPWAP bug suggests the exposed surface is the fabric access service on an interface, which opens UDP 5246-5249.

Do you really need to act?#

Yes, if you operate Fortinet gear. The two bugs carry different risks:

• CVE-2025-25249: pre-authentication and exploited at scale. If any interface facing an untrusted network allows fabric, assume it has been probed. Patch today, and hunt.
• CVE-2025-61624: needs an admin login with read-write rights, so it is an escalation, not an entry point. The PEERSTITCH case shows how admin credentials leak in practice: a compromised management platform hands over every managed device. If your FortiGates sit behind a FortiManager or MSP, take this seriously.

Patching shuts the door but does not evict anyone. SOCRadar notes that an existing implant and stolen credentials survive an upgrade.

What to do now#

1. Inventory versions with get system status on each device or from FortiManager.
2. Upgrade to 7.4.10+ or 7.6.5+, starting with internet-facing units. Plan migrations for 7.2, 7.0 and 6.4.
3. Until patched, remove fabric from set allowaccess under config system interface on every untrusted interface, or add a local-in policy that drops UDP 5246-5249 except from trusted devices, as FG-IR-25-084 describes.
4. Hunt (next section) before and after upgrading.
5. If you find artifacts, rebuild from known-good firmware and configuration. Rotate admin, SSL-VPN, LDAP, wireless PSK and IPsec secrets, and enforce MFA for admins.

How to tell if you were hit#

For PivotC2, SOCRadar suggests fnsysctl ls -la /tmp/ (look for .i.js), then diagnose sys session filter daddr 46.151.29.58 (and 146.103.99.177) followed by diagnose sys session list. Process names alone are unreliable because Node.js ships with FortiOS. For PEERSTITCH, Unit 42 lists auto-script objects with names like ../../../../setup, Signal 11 crashes in miglogd, iked or syslogd in diagnose debug crashlog read, and connections over FGFM (TCP 541) from unfamiliar hosts. Triskele Labs repeats the PivotC2 checks for responders.

Timeline#

• Sep 2024 — The PEERSTITCH intrusion begins with FortiManager CVE-2024-47575 (Unit 42).
• Jan 13, 2026 — Fortinet publishes FG-IR-25-084 (CVE-2025-25249).
• Feb 23, 2026 — FortiOS 6.4.17 is removed from the fixed versions.
• Apr 14, 2026 — Fortinet publishes FG-IR-26-122 (CVE-2025-61624), marked known exploited.
• Sep 8, 2026 — SOCRadar reports PivotC2 exploitation of CVE-2025-25249, dating back to at least July.
• Sep 9, 2026 — CISA adds CVE-2025-25249 to KEV.
• Oct 14, 2026 — Unit 42 publishes its PEERSTITCH research.
• Oct 16, 2026 — CISA adds CVE-2025-61624 to KEV.

Vulnerability records

• CVE-2025-25249 · KEV 2026-09-09 · A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…
• CVE-2025-61624 · KEV 2026-10-16 · An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Fortinet PSIRT — FG-IR-25-084: Heap-based buffer overflow in cw_acd daemon (CVE-2025-25249) fortiguard.fortinet.com
2. Fortinet PSIRT — FG-IR-26-122: Path Traversal in CLI (CVE-2025-61624) fortiguard.fortinet.com
3. CVE record — CVE-2025-25249 cve.org
4. CVE record — CVE-2025-61624 cve.org
5. NVD — CVE-2025-25249 nvd.nist.gov
6. NVD — CVE-2025-61624 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-25249 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2025-61624 cisa.gov
9. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 9, 2026) cisa.gov
10. SOCRadar — CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT socradar.io
11. Unit 42 — Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant unit42.paloaltonetworks.com
12. Triskele Labs — Critical Fortinet FortiOS RCE under active exploitation (CVE-2025-25249) triskelelabs.com