Fortinet CVE-2025-25249: PivotC2 Node.js RAT on FortiGate after cw_acd RCE

Update, Sep 16: Confirmed US intrusions went on to credential theft and mailbox exfiltration after the firewall foothold. If compromise is plausible, isolate the device and preserve forensics, then rotate VPN pre-shared keys, LDAP bind and admin credentials and any other secrets stored on the FortiGate, and re-issue certificates. Researchers cite PivotC2 artifacts at paths such as /tmp/.i.js; also look for unexpected outbound TLS or reverse SSH from the firewall.

What Changed

SOCRadar reports that Russian-speaking cybercrime actors have been exploiting CVE-2025-25249, an unauthenticated heap-based buffer overflow in the FortiOS and FortiSwitchManager cw_acd (CAPWAP) daemon, to deploy PivotC2, a Node.js remote access trojan purpose-built for FortiGate post-exploitation. Fortinet advisory FG-IR-25-084 states the bug may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted requests, while noting that ASLR and PIE raise exploit complexity. Patches shipped in January 2026.

Score the severity carefully in triage meetings: Fortinet rates the issue CVSS 7.4; NVD and SOCRadar cite 9.8. The scores disagree. Exploitation is confirmed either way. CISA added CVE-2025-25249 to KEV on September 9, 2026 with a federal remediation due date of September 12, a compressed BOD 26-04 window, and forensic-triage expectations for internet-exposed assets.

Victim counts (SOCRadar-derived): attackers targeted more than 30,000 IP addresses; SOCRadar reports 178 devices infected with PivotC2, concentrated in the United States, with at least two intrusions progressing to confirmed data exfiltration. Treat these figures as SOCRadar’s campaign telemetry, not a global census. Reported PivotC2 capabilities include interactive shell, traffic tunneling, network scanning, and configuration or credential harvesting.

Why This Matters Operationally

Perimeter firewalls that speak CAPWAP on UDP 5246–5249, especially with fabric or CAPWAP access enabled on internet-facing interfaces—are the entry condition. Once PivotC2 lands, operators lose the assumption that “the FortiGate is the trusted chokepoint.” Unauthenticated RCE on firewall OS plus a native RAT observed since at least July 2026 closes the 7.4-versus-9.8 debate for anyone still waiting.

What Defenders Should Verify First

• Patch to FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18+ (migrate off all FortiOS 6.4) and FortiSwitchManager 7.2.7 or 7.0.6+ per FG-IR-25-084.
• Inventory internet exposure of CAPWAP-CONTROL (UDP 5246–5249) on fabric-enabled interfaces; apply Fortinet’s local-in policy guidance to allow only trusted CAPWAP peers if you cannot patch immediately—then still patch.
• Forensically triage internet-exposed FortiGates for activity from July 2026 onward: unexpected Node.js processes, unauthorized admin/VPN/wireless accounts, config diffs, tunneling artifacts, and credential or cloud-bucket exfil patterns associated with follow-on intrusions.
• Do not let the CVSS split slow patching—KEV plus an in-the-wild RAT is the decision signal.

Source Context

• Fortinet FG-IR-25-084 (CVE-2025-25249)
• SecurityWeek: Fortinet flaw exploited in PivotC2 RAT attacks
• CISA KEV: CVE-2025-25249 added September 9, 2026

Related: see every Fortinet vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].