Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks

1. Executive summary

Threat actors are exploiting CVE-2025-25249, an unauthenticated heap-based buffer overflow (CVSS 8.1 HIGH, CWE-122/CWE-787) affecting FortiOS and FortiSwitchManager, to deploy a Node.js remote access trojan dubbed PivotC2. The flaw was patched by Fortinet in January 2026 across FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, and FortiSwitchManager 7.2.7 and 7.0.6, yet CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-09, confirming active exploitation. SOCRadar reports the campaign scanned more than 30,000 IP addresses and successfully infected 178 devices, with at least two intrusions in US entities resulting in data exfiltration. Fortinet edge devices are heavily deployed across EMEA financial services; any unpatched FortiGate or FortiSwitchManager exposed to the internet is at immediate risk of unauthenticated RCE followed by interactive-shell implant deployment. Attribution to a Russian-speaking cybercrime actor is unconfirmed and rests on a single vendor report.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged beyond these facts; the generic presence of a vulnerability does not itself trigger NIS2 Art. 21(2)(d) supply chain measures or Art. 23 reporting absent a confirmed incident on an in-scope entity.

3. Technical analysis & attack chain

Confirmed attack chain (per SOCRadar, single-sourced)

1. Reconnaissance: Threat actors scanned and targeted more than 30,000 IP addresses running vulnerable FortiOS/FortiSwitchManager builds.
2. Initial access: Exploitation of CVE-2025-25249, an unauthenticated heap-based buffer overflow reachable via "specifically crafted requests" — no credentials required, per Fortinet's advisory.
3. Payload deployment: Delivery of PivotC2, a Node.js-based RAT, onto the compromised FortiGate device.
4. Post-exploitation: Use of PivotC2's capabilities — interactive shell access, traffic tunneling, network scanning, and configuration harvesting — for follow-on activity.
5. Impact: Of 30,000+ targeted IPs, 178 devices were infected; at least two intrusions at US entities resulted in data exfiltration.

Vulnerability mechanism. CVE-2025-25249 is a heap-based buffer overflow (CWE-122) / out-of-bounds write (CWE-787) permitting arbitrary code or command execution by a remote, unauthenticated attacker. Note a discrepancy: the SecurityWeek report quotes a CVSS score of 7.4, while the authoritative NVD record scores it 8.1 HIGH — treat 8.1 as the working value. The specific Fortinet component and request type triggering the overflow are not detailed in the available sources; do not assume a specific management interface without vendor PSIRT detail.

Malware capabilities (PivotC2). A FortiGate post-exploitation implant providing: interactive shell access; traffic tunneling (pivoting into the internal network from the edge device); network scanning (internal discovery); and configuration harvesting (extraction of device configuration, which on FortiGate typically contains credentials, VPN settings and certificate material — the configuration-harvesting claim is SOCRadar's; the specific data types harvested are not enumerated in the source). SOCRadar assesses PivotC2 was likely developed with AI assistance and has been in use since at least July 2026. Both the AI-development claim and the usage timeline are single-sourced vendor assessments.

Attribution. SOCRadar assesses the actors are "likely" a Russian-speaking cybercrime actor. No MITRE ATT&CK group profile exists for this actor in our verified reference data, and no corroborating attribution is available — treat as unconfirmed, single-sourced. Do not propagate the Russian-speaking assessment into enforcement or threat-hunting prioritisation decisions without independent corroboration.

Observed impact. Targeting was mainly against US entities. No EMEA financial-sector victims are named in the available sources; the exposure assessment for EMEA clients is based on product prevalence, not observed regional victimology.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and patch. Enumerate all FortiGate/FortiOS and FortiSwitchManager instances. Upgrade to FortiOS 7.6.4, 7.4.9, 7.2.12 or 7.0.18, or FortiSwitchManager 7.2.7 or 7.0.6, or newer. This is the vendor fix; there is no stated workaround.
• Isolate unpatchable devices. Any instance that cannot be patched immediately: remove management/admin interfaces from internet exposure (management-access ACLs restricting to internal/management VLANs), or take the device offline if it serves no business-critical edge function.
• Hunt for compromise before patching. Patching an already-infected device does not remove an implanted RAT. On every FortiGate in the vulnerable version range, review configuration changes, admin account creation, and unexpected outbound sessions. PivotC2 provides interactive shell and tunneling — look for anomalous outbound connections from the device itself.

P2 — within 72 hours

• Perimeter exposure review. Confirm no FortiOS/FortiSwitchManager admin plane is internet-reachable; enforce management access via jump host or dedicated management interface.
• Configuration credential rotation. For any device that was vulnerable and internet-exposed, rotate all credentials stored in the FortiGate configuration (admin accounts, VPN pre-shared keys, RADIUS/LDAP bind credentials, certificates) on the assumption that configuration harvesting occurred.
• Internal network monitoring. PivotC2's scanning and tunneling capabilities mean an infected edge device is a pivot point. Review east-west traffic originating from FortiGate IP space for scanning patterns and unexpected tunnels.

P3 — within 7 days

• Version pinning and SLA alignment. Add FortiOS/FortiSwitchManager to the CISA-KEV-driven emergency patch track; KEV additions should trigger patching SLAs shorter than the standard cycle.
• Post-incident review. For any confirmed exploitation, run the DORA Art. 19 major-incident classification and, where thresholds are met, report to the competent authority.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (derived from the described campaign; no atomic IOCs were published in the available sources):

6. Detection

Insufficient indicators to author detection rules.

The available sources describe campaign scale and malware capabilities but publish no file hashes, C2 domains or IPs, file paths, mutexes, or distinctive strings belonging to PivotC2. Authoring a YARA or Sigma rule from the product name or CVE identifier would detect reporting about the threat, not the threat itself. We will reissue detection content if SOCRadar's full report or Fortinet's PSIRT advisory publishes artefacts.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• SecurityWeek — Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks — https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/ — 2026-09-10
• SOCRadar (via SecurityWeek reporting) — PivotC2 RAT campaign analysis — as cited in the above article
• ANSSI France CERT — Multiples vulnérabilités dans les produits Fortinet — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1015/ — 2026-08-13
• ANSSI France CERT — Multiples vulnérabilités dans les produits Fortinet — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0725/ — 2026-06-10
• CISA Known Exploited Vulnerabilities catalog — CVE-2025-25249 addition (2026-09-09), per SecurityWeek reporting

8. Adverse Trace position

This is a high-severity (CVSS 8.1, NVD-authoritative), actively exploited, unauthenticated RCE on perimeter security appliances — the worst combination available to a financial services network, and the KEV listing on 2026-09-09 confirms it is being used in the wild with a working implant pipeline behind it. The patch has existed since January 2026, so any client still running FortiOS < 7.6.4/7.4.9/7.2.12/7.0.18 or FortiSwitchManager < 7.2.7/7.0.6 on an internet-exposed interface has an unmanaged patch gap that their DORA Art. 24 testing regime should have surfaced. The campaign detail — 178 infections, PivotC2 capabilities, AI-development assessment, and Russian-speaking actor attribution — is entirely single-sourced to SOCRadar; treat it as directionally reliable but verify before using it for enforcement, and note that victimology is US-centric with no confirmed EMEA financial-sector victims in the available reporting. Our next steps: monitor for the SOCRadar technical report and Fortinet PSIRT advisory to obtain PivotC2 IOCs for §5/§6 reissue, track any EMEA victim reporting, and update this advisory if the CVSS discrepancy (7.4 vendor-quoted vs 8.1 NVD) resolves or if attribution gains corroboration.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.