~/f4n6 $ grep -r "CVE-2025-25249 — Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability" ./investigations/ --include="*.md"

CVE-2025-25249 — Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Jeff Davies 09 Sep 2026 6 min read

1. Executive summary

CVE-2025-25249 is a heap-based buffer overflow (CWE-122 / CWE-787) affecting Fortinet FortiOS, FortiSwitchManager and FortiSASE, rated CVSS 8.1 HIGH, with EPSS at 1% and no confirmed inclusion in the CISA Known Exploited Vulnerabilities catalogue as of the verified reference data. Successful exploitation allows an attacker to execute unauthorised code or commands via specially crafted packets — a pre-authentication remote code execution primitive on perimeter devices that are, by design, internet-facing at most financial institutions. The affected version ranges are broad and include supported and legacy FortiOS branches (6.4.0–6.4.16, 7.0.0–7.0.17, 7.2.0–7.2.11, 7.4.0–7.4.8, 7.6.0–7.6.3), FortiSwitchManager 7.0.0–7.0.5 and 7.2.0–7.2.6, and FortiSASE 25.1.a.2 and 25.2.b. The NVD entry carries a remediation due date of 2026-09-12 — three days from issuance — which makes this a same-week patch cycle for any client running affected Fortinet edge infrastructure. No ransomware campaign use is recorded against this CVE.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements The vulnerability sits in perimeter network infrastructure (FortiOS firewalls, FortiSwitchManager, FortiSASE) whose compromise would defeat boundary controls; the 2026-09-12 remediation deadline requires clients to demonstrate that ICT supporting critical functions is tested and patched against known exploitable flaws within the mandated window. Clients must evidence that Fortinet edge assets are in scope for vulnerability management and patch testing, and that the fix is validated before the due date rather than deferred through the standard change cycle.
DORA Art. 28: ICT third-party risk — general principles FortiSASE is a vendor-operated SASE service; the required action for cloud services under the advisory is to follow vendor mitigation guidance or discontinue use where mitigations are unavailable — placing remediation dependency on Fortinet as ICT third-party provider. Clients consuming FortiSASE must confirm with Fortinet that the affected service versions (25.1.a.2, 25.2.b) are remediated on the provider side, and record that confirmation in third-party risk files.

No NIS2 or UK NIS article is directly engaged by the facts of this item beyond generic patching duties.

3. Technical analysis & attack chain

Vulnerability mechanism. CVE-2025-25249 is a heap-based buffer overflow (NVD records CWE-122, heap-based buffer overflow, and CWE-787, out-of-bounds write) in FortiOS, FortiSwitchManager and FortiSASE. The flaw permits execution of unauthorised code or commands when the affected product processes specially crafted packets. The verified reference data does not identify the specific vulnerable component, service, or protocol within FortiOS that handles the malformed input, and no public exploit path, proof-of-concept, or technical write-up is present in the source material. EPSS is 1%, indicating low near-term exploitation probability against the general population of internet-facing hosts, and the CVE is not listed in CISA KEV per the verified data.

Affected versions (from the GitHub advisory, corroborating the NVD entry)

  • FortiOS 7.6.0–7.6.3
  • FortiOS 7.4.0–7.4.8
  • FortiOS 7.2.0–7.2.11
  • FortiOS 7.0.0–7.0.17
  • FortiOS 6.4.0–6.4.16
  • FortiSASE 25.2.b
  • FortiSASE 25.1.a.2
  • FortiSwitchManager 7.2.0–7.2.6
  • FortiSwitchManager 7.0.0–7.0.5

Attack chain — what is confirmed versus inferred. The only confirmed step is: an attacker sends specially crafted packets to an affected FortiOS / FortiSwitchManager / FortiSASE instance, triggering a heap-based out-of-bounds write that leads to unauthorised code or command execution. Everything beyond that — pre-authentication reachability, specific port or protocol, post-exploitation behaviour, persistence, C2, or lateral movement — is not described in the source material and we will not speculate. No threat actor attribution is claimed for this CVE in any source; there is no MITRE ATT&CK profile to cite and no exploitation reporting specific to this vulnerability.

Context from related Fortinet activity (single-sourced or tangential — do not conflate with this CVE). The related sources describe a separate, actively exploited cluster of FortiSandbox vulnerabilities (CVE-2026-39813 path traversal / auth bypass, CVE-2026-39808 and CVE-2026-25089 OS command injection, all CVSS 9.1), reported by threat-intel firm Defused via The Register, and two ANSSI CERT-FR advisories (CERTFR-2026-AVI-0879 of 15 July 2026 and CERTFR-2026-AVI-1015 of 13 August 2026) covering multiple Fortinet product vulnerabilities permitting remote code execution, privilege escalation, denial of service and confidentiality impact. These are distinct vulnerabilities in different products. They are relevant only as evidence that Fortinet perimeter and security products are under sustained attacker attention in 2026 — which argues for urgency on CVE-2025-25249 despite its low EPSS — not as evidence that CVE-2025-25249 itself is being exploited. The Register's reporting on the FortiSandbox exploitation is single-sourced (Defused's LinkedIn post); verify before treating it as established.

4. Mitigation & containment

P1 — within 24 hours

  1. Inventory and exposure check. Enumerate all FortiOS, FortiSwitchManager and FortiSASE instances against the affected version ranges above. Prioritise any FortiOS device with management or packet-processing interfaces reachable from the internet.
  2. Apply the vendor fix. Upgrade affected FortiOS branches to the first patched release above each affected range (i.e. beyond 7.6.3, 7.4.8, 7.2.11, 7.0.17 and 6.4.16 respectively), FortiSwitchManager beyond 7.2.6 / 7.0.5, and confirm FortiSASE remediation with Fortinet for tenants on 25.1.a.2 / 25.2.b. The NVD entry sets a remediation due date of 2026-09-12; treat this as the hard deadline. Where an immediate upgrade is not feasible, apply any vendor interim mitigation Fortinet has published and restrict management-plane access accordingly.
  3. Restrict the management plane. Where patching cannot complete within the window, constrain management access to FortiOS/FortiSwitchManager admin interfaces to dedicated admin VLANs or VPN-only reachability, and confirm no admin/HTTPS/SSH listeners are exposed to untrusted networks.

P2 — within 72 hours

  1. Hunt for signs of prior exploitation. The source material provides no IOCs specific to this CVE, so hunt on anomaly rather than signature: unexpected configuration changes, unexplained admin sessions in device logs, new local users, modified firmware, or crashes/reboots of affected devices consistent with heap corruption. Where compromise is suspected, follow CISA's forensics triage guidance referenced in the NVD entry and preserve device images before remediation.
  2. Validate the fix. Post-upgrade, confirm the running firmware version is outside every affected range and re-run configuration backups.

P3 — within 7 days

  1. Retire legacy branches. FortiOS 6.4 is at the end of its affected range (6.4.16); clients still on 6.4 should treat this cycle as the trigger to plan migration to a supported branch, as repeated out-of-range patching of legacy FortiOS is not sustainable.
  2. Third-party confirmation for FortiSASE. Record Fortinet's confirmation that the SASE tenant is remediated, per the DORA Art. 28 trigger above.

5. Indicators of compromise

No indicators of compromise available in the source material.

No behavioural indicators specific to exploitation of CVE-2025-25249 are described in the sources; the only observable behaviour implied is device instability (crash/reboot) consistent with heap corruption, which is non-specific and should not be treated as a reliable signal on its own.

6. Detection

Insufficient indicators to author detection rules.

The source material contains no strings, file paths, registry keys, command-line artefacts, mutexes, or network signatures attributable to exploitation of CVE-2025-25249. A rule keyed to the CVE identifier or product names would detect reporting about the vulnerability, not exploitation of it, and is therefore not emitted.

CVE assessment

1 referenced CVE

CVE CVSS Exploited EPSS Summary
CVE-2025-25249 8.1 High — 1% A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0…

7. Sources

  • NVD, CVE-2025-25249 — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2025-25249, published 2026-09-08
  • GitHub Security Advisories, GHSA-mj8x-m8f5-x4w8 — Heap-based buffer overflow in FortiOS / FortiSwitchManager / FortiSASE, https://github.com/advisories/GHSA-mj8x-m8f5-x4w8
  • ANSSI CERT-FR, CERTFR-2026-AVI-1015 — Multiples vulnérabilités dans les produits Fortinet, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1015/, 13 August 2026
  • ANSSI CERT-FR, CERTFR-2026-AVI-0879 — Multiples vulnérabilités dans les produits Fortinet, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0879/, 15 July 2026
  • The Register, Three critical Fortinet sandbox bugs splattered by unknown attackers, https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461, 16 June 2026
  • NVD, CVE-2026-25089 — Fortinet FortiSandbox OS Command Injection Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-25089
  • NVD, CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2025-68686

8. Adverse Trace position

CVE-2025-25249 is a CVSS 8.1 HIGH heap-based buffer overflow with a code-execution outcome on Fortinet perimeter products — serious by mechanism, but currently sitting at 1% EPSS with no CISA KEV listing and no exploitation reporting in the verified data, so we assess it as a patch-priority vulnerability, not an active-threat emergency. The 2026-09-12 remediation due date in the NVD entry is the binding constraint: clients running affected FortiOS, FortiSwitchManager or FortiSASE versions should complete upgrades inside that window, with internet-exposed management planes first. We are explicitly not treating the FortiSandbox exploitation reporting (CVE-2026-39813 / -39808 / -25089) as evidence of exploitation of this CVE — that reporting is single-sourced to Defused via The Register and concerns different products and flaws. Confidence in the vulnerability facts is high (NVD plus a corroborating GitHub advisory); confidence in any exploitation assessment is low pending independent reporting. Adverse Trace will monitor for KEV listing, EPSS movement, and any Fortinet PSIRT advisory or technical write-up identifying the vulnerable component, and will reissue this note if exploitation is confirmed or the affected surface is refined.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies