---
title: "FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited"
url: https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/
description: "Pre-auth FortiOS CAPWAP RCE (PivotC2 RAT) and admin CLI path traversal (PEERSTITCH implant) are in KEV. Upgrade to 7.4.10+ or 7.6.5+ and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-01-13
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2025-25249", "CVE-2025-61624"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited

**Verdict: Act now.** If you run FortiGates, get to FortiOS 7.4.10+ or 7.6.5+ now and hunt for implants: one bug gives unauthenticated attackers code execution over CAPWAP and is being exploited at scale, and the other turns stolen admin logins into root implants.

- **Who must act:** Owners of FortiGate firewalls and FortiSwitchManager, FortiProxy or FortiPAM appliances below the fixed builds, starting with any device that has the fabric service or CAPWAP (UDP 5246-5249) reachable from untrusted networks.
- **Who can relax:** FortiSASE customers (Fortinet patched the service itself), devices already on FortiOS 7.4.10+ or 7.6.5+ that show no signs of compromise, and teams with no Fortinet equipment.
- **Affected:** FortiOS 7.6.0 through 7.6.4 (7.6.0-7.6.3 for CVE-2025-25249); FortiOS 7.4.0 through 7.4.9 (7.4.0-7.4.8 for CVE-2025-25249); FortiOS 7.2 and 7.0, all versions for CVE-2025-61624 (7.2.0-7.2.11 and 7.0.0-7.0.17 for CVE-2025-25249); FortiOS 6.4 (all versions); FortiSwitchManager 7.2.0-7.2.7 and 7.0.0-7.0.6; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.11, all 7.2 and 7.0 (CVE-2025-61624); FortiPAM 1.0 through 1.7.0 (CVE-2025-61624)
- **Fixed:** FortiOS 7.6.5 or later (both CVEs); FortiOS 7.4.10 or later (both CVEs); FortiOS 7.2.12 / 7.0.18 fix CVE-2025-25249 only; 7.2, 7.0 and 6.4 must migrate for CVE-2025-61624; FortiSwitchManager 7.2.8 or 7.0.7; FortiProxy 7.6.5 or 7.4.12; FortiPAM 1.7.1 or 1.8
- **CVEs:** CVE-2025-25249, CVE-2025-61624
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every FortiGate, FortiSwitchManager, FortiProxy and FortiPAM with its version (get system status).
2. Upgrade FortiOS to 7.4.10+ or 7.6.5+, which covers both CVEs; move 7.2, 7.0 and 6.4 units to a fixed branch.
3. Until patched, remove the fabric service from internet-facing interfaces and block UDP 5246-5249 from untrusted networks with a local-in policy.
4. Hunt for PivotC2 and PEERSTITCH indicators before and after patching; an upgrade does not remove an implant.
5. If you find indicators, rebuild the device from known-good firmware and config, and rotate admin, SSL-VPN, LDAP, wireless and IPsec secrets.
6. Require MFA and unique credentials for FortiGate admins, and keep FortiManager and management interfaces off the internet.

### How to check if you are affected

- Check for the PivotC2 stager with fnsysctl ls -la /tmp/ (look for .i.js) and for sessions to 46.151.29.58 or 146.103.99.177 using diagnose sys session filter daddr <IP> then diagnose sys session list.
- Search the configuration for auto-script objects whose names contain ../, such as ../../../../setup, which Unit 42 tied to PEERSTITCH.
- Run diagnose debug crashlog read and look for Signal 11 crashes in miglogd, iked or syslogd.
- Review admin logins and config changes for unfamiliar sources, especially on FortiGates managed by a FortiManager that was exposed to CVE-2024-47575.

## What happened

Two FortiOS flaws disclosed earlier in 2026 have been added to CISA's Known Exploited Vulnerabilities catalog. One is serious on its own. The other is dangerous for anyone whose admin credentials have leaked.

**CVE-2025-25249** ([FG-IR-25-084](https://fortiguard.fortinet.com/psirt/FG-IR-25-084), published January 13, 2026) is a heap-based buffer overflow in `cw_acd`, the CAPWAP daemon in FortiOS and FortiSwitchManager. A remote, unauthenticated attacker can send crafted requests to execute code. Fortinet found it internally and scores it CVSS 3.1 8.1. It notes that ASLR and PIE make exploitation harder but do not prevent it. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-25249) scores it 9.8. Fortinet's advisory still says "Known Exploited: No." On September 8, [SOCRadar](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/) reported exploitation since at least July 2026: more than 30,000 targeted IPs and 178 devices infected with PivotC2, a Node.js remote access trojan that harvests FortiGate configurations and decrypts stored secrets. It also confirmed two U.S. intrusions with data exfiltration. SOCRadar attributes the activity to a Russian-speaking, financially motivated operator. CISA added the CVE the next day, in its [September 9 alert](https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog).

**CVE-2025-61624** ([FG-IR-26-122](https://fortiguard.fortinet.com/psirt/FG-IR-26-122), April 14, 2026) is a path traversal in the CLI of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. It lets a privileged user write or delete arbitrary files. The vendor rates it 6.0 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-61624): 6.5) and marked it "Known Exploited: Yes" from day one. On October 14, [Unit 42](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) explained how. Attackers who breached a telecom MSP's FortiManager through CVE-2024-47575, starting in September 2024, took a configuration archive covering more than 500 managed FortiGates and brute-forced credentials from it. They then used an unsanitized auto-script name to run code as root and injected the PEERSTITCH implant into the `miglogd` and `iked` daemons. Unit 42 says the implant reached "a select number of firewalls," not all 500. CISA added the CVE on October 16.

## Who is affected

FortiOS 7.6.4 and 7.4.9 fix CVE-2025-25249. FortiOS 7.6.5 and 7.4.10 fix both bugs. FortiOS 7.2.12 and 7.0.18 fix only the CAPWAP flaw, and Fortinet tells 7.2, 7.0 and 6.4 users to migrate for CVE-2025-61624. Fortinet removed 6.4.17 from its fixed list in February, so no 6.4 build is fixed for CVE-2025-25249 either. FortiSwitchManager needs 7.2.8 or 7.0.7, FortiProxy 7.6.5 or 7.4.12, and FortiPAM 1.7.1 or 1.8. The [CVE-2025-25249](https://www.cve.org/CVERecord?id=CVE-2025-25249) and [CVE-2025-61624](https://www.cve.org/CVERecord?id=CVE-2025-61624) records say Fortinet fixed FortiSASE in the service itself, so customers need do nothing. Fortinet's workaround for the CAPWAP bug suggests the exposed surface is the `fabric` access service on an interface, which opens UDP 5246-5249.

## Do you really need to act?

Yes, if you operate Fortinet gear. The two bugs carry different risks:

- **CVE-2025-25249:** pre-authentication and exploited at scale. If any interface facing an untrusted network allows `fabric`, assume it has been probed. Patch today, and hunt.
- **CVE-2025-61624:** needs an admin login with read-write rights, so it is an escalation, not an entry point. The PEERSTITCH case shows how admin credentials leak in practice: a compromised management platform hands over every managed device. If your FortiGates sit behind a FortiManager or MSP, take this seriously.

Patching shuts the door but does not evict anyone. SOCRadar notes that an existing implant and stolen credentials survive an upgrade.

## What to do now

1. Inventory versions with `get system status` on each device or from FortiManager.
2. Upgrade to 7.4.10+ or 7.6.5+, starting with internet-facing units. Plan migrations for 7.2, 7.0 and 6.4.
3. Until patched, remove `fabric` from `set allowaccess` under `config system interface` on every untrusted interface, or add a local-in policy that drops UDP 5246-5249 except from trusted devices, as FG-IR-25-084 describes.
4. Hunt (next section) before and after upgrading.
5. If you find artifacts, rebuild from known-good firmware and configuration. Rotate admin, SSL-VPN, LDAP, wireless PSK and IPsec secrets, and enforce MFA for admins.

## How to tell if you were hit

For PivotC2, SOCRadar suggests `fnsysctl ls -la /tmp/` (look for `.i.js`), then `diagnose sys session filter daddr 46.151.29.58` (and `146.103.99.177`) followed by `diagnose sys session list`. Process names alone are unreliable because Node.js ships with FortiOS. For PEERSTITCH, Unit 42 lists auto-script objects with names like `../../../../setup`, Signal 11 crashes in `miglogd`, `iked` or `syslogd` in `diagnose debug crashlog read`, and connections over FGFM (TCP 541) from unfamiliar hosts. [Triskele Labs](https://www.triskelelabs.com/resources/critical-fortinet-fortios-remote-code-execution-vulnerability-under-active-exploitation-cve-2025-25249) repeats the PivotC2 checks for responders.

## Timeline

- Sep 2024 — The PEERSTITCH intrusion begins with FortiManager CVE-2024-47575 (Unit 42).
- Jan 13, 2026 — Fortinet publishes FG-IR-25-084 (CVE-2025-25249).
- Feb 23, 2026 — FortiOS 6.4.17 is removed from the fixed versions.
- Apr 14, 2026 — Fortinet publishes FG-IR-26-122 (CVE-2025-61624), marked known exploited.
- Sep 8, 2026 — SOCRadar reports PivotC2 exploitation of CVE-2025-25249, dating back to at least July.
- Sep 9, 2026 — CISA adds CVE-2025-25249 to KEV.
- Oct 14, 2026 — Unit 42 publishes its PEERSTITCH research.
- Oct 16, 2026 — CISA adds CVE-2025-61624 to KEV.

## Sources

1. [Fortinet PSIRT — FG-IR-25-084: Heap-based buffer overflow in cw_acd daemon (CVE-2025-25249)](https://fortiguard.fortinet.com/psirt/FG-IR-25-084)
2. [Fortinet PSIRT — FG-IR-26-122: Path Traversal in CLI (CVE-2025-61624)](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)
3. [CVE record — CVE-2025-25249](https://www.cve.org/CVERecord?id=CVE-2025-25249)
4. [CVE record — CVE-2025-61624](https://www.cve.org/CVERecord?id=CVE-2025-61624)
5. [NVD — CVE-2025-25249](https://nvd.nist.gov/vuln/detail/CVE-2025-25249)
6. [NVD — CVE-2025-61624](https://nvd.nist.gov/vuln/detail/CVE-2025-61624)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-25249](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249)
8. [CISA — Known Exploited Vulnerabilities: CVE-2025-61624](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624)
9. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 9, 2026)](https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)
10. [SOCRadar — CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)
11. [Unit 42 — Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
12. [Triskele Labs — Critical Fortinet FortiOS RCE under active exploitation (CVE-2025-25249)](https://www.triskelelabs.com/resources/critical-fortinet-fortios-remote-code-execution-vulnerability-under-active-exploitation-cve-2025-25249)

---
Source page: https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt