CVE-2025-25249: Fortinet FortiOS, FortiSwitchManager & FortiSASE Heap Overflow Under Active Exploitation — Detection and Remediation Guide

On September 9, 2026, CISA added CVE-2025-25249 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in IR have suspected for weeks: a heap-based buffer overflow affecting Fortinet FortiOS, FortiSwitchManager, and FortiSASE is being actively exploited in the wild. The flaw allows an unauthenticated or low-privilege attacker to execute unauthorized code or commands on the target appliance by sending specially crafted packets to an affected service.

Let me be blunt about why this matters. Fortinet edge devices are the front door to your network. They terminate VPNs, enforce policy, and — critically — they hold credentials, routing tables, and session state for everything behind them. A code-execution primitive on FortiOS is not a nuisance bug; it is a beachhead. In the engagements we've responded to over the past three years, compromised Fortinet appliances have been used for persistence (rogue local admin accounts), credential harvesting, configuration theft, and as quiet pivot points into flat internal networks. If you run FortiGate firewalls, FortiSwitchManager instances, or consume FortiSASE, this is a drop-everything remediation item.

CISA's required action language is explicit: apply vendor mitigations, comply with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements, follow applicable cloud guidance for FortiSASE, or discontinue use of the product if mitigations are unavailable. That last clause is not boilerplate — treat it as a statement of how serious the exploitation picture is.

Technical Analysis

Affected Products

Per the CISA KEV entry and vendor guidance:

• FortiOS — the operating system powering FortiGate NGFW appliances and virtual machines
• FortiSwitchManager — centralized management for FortiSwitch infrastructure
• FortiSASE — Fortinet's cloud-delivered SASE offering (cloud tenants must follow BOD 26-04 cloud service guidance and confirm provider-side remediation)

The vulnerability is a heap-based buffer overflow reachable via specially crafted network packets. Consult the Fortinet PSIRT advisory for the exact fixed firmware builds for your train — do not assume your current GA release is patched simply because it is recent.

How the Vulnerability Works — Defender's View

Heap overflows in network-facing daemons on security appliances are a favorite of sophisticated actors for good reason:

1. Pre-auth or low-auth reachability. The vulnerable code path processes incoming packets, meaning the attacker needs network reachability to the affected service — not credentials. If your management or affected service interfaces are exposed to the internet or to broad internal segments, assume reachability.
2. Memory corruption → code execution. By overflowing a heap buffer, the attacker corrupts adjacent memory structures to hijack execution flow, landing arbitrary code or command execution in the context of the affected process — typically a privileged daemon on the appliance.
3. Post-exploitation pattern. In observed Fortinet compromises, the follow-on behaviors are consistent: creation of rogue local administrator accounts, modification of firewall policies to permit attacker C2, export of the device configuration (which contains hashed credentials, VPN pre-shared keys, and network topology), deployment of persistence mechanisms, and log tampering.

Exploitation Status

• Confirmed active exploitation in the wild — that is the bar for KEV inclusion. This is not theoretical and not PoC-only.
• CISA KEV listed: 2026-09-09
• Federal Civilian Executive Branch agencies are bound by the remediation due date in the KEV catalog entry under Binding Operational Directive requirements; private sector organizations should treat that same date as their effective SLA.

Detection & Response

Because this is a network appliance vulnerability, your telemetry lives in the FortiGate event/system logs, not on Windows endpoints. Ship Fortinet logs to your SIEM via syslog/CEF if you aren't already — if your FortiGates aren't logging to an external collector, that gap is itself a finding, because log tampering is a standard post-exploitation step.

Hunt for the behaviors that follow exploitation of an edge appliance: rogue admin creation, anomalous management logins, and configuration export.

---
title: FortiGate Rogue Local Administrator Account Created
id: 8c2f4a91-3b6d-4e57-a921-5f7c8d9e0a1b
status: experimental
description: Detects creation of a new local administrator account on a FortiGate appliance, a common persistence mechanism following edge device exploitation such as CVE-2025-25249.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: fortinet
  service: event
detection:
  selection:
    msg|contains:
      - 'added a new administrator'
      - 'Add admin'
      - 'created administrator'
falsepositives:
  - Legitimate provisioning of new admin accounts during change windows — correlate against change tickets
level: high
---
title: FortiGate Administrator Login From External or Untrusted Source
id: 2d9e7b45-6a1c-4f83-b5d2-8e4a6c1f9037
status: experimental
description: Detects successful administrator logins to FortiGate management interfaces originating from non-RFC1918 or otherwise untrusted source addresses, consistent with post-exploitation access to appliances affected by CVE-2025-25249.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  product: fortinet
  service: event
detection:
  selection:
    logdesc|contains: 'login successfully'
    action: 'login'
  filter_private:
    srcip|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_private
falsepositives:
  - Misconfigured NAT exposing internal source addresses
  - Managed service provider access from fixed external IPs — maintain an allowlist
level: high
---
title: FortiGate Configuration Backup or Export Activity
id: 4a6c1d82-9f3e-4b75-c2a8-1d5e7f902346
status: experimental
description: Detects backup or download of the FortiGate system configuration, which contains hashed credentials and VPN keys and is routinely exfiltrated after edge appliance compromise including CVE-2025-25249 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.collection
  - attack.t1005
logsource:
  product: fortinet
  service: event
detection:
  selection:
    msg|contains:
      - 'backup'
      - 'Backup config'
      - 'download the configuration'
      - 'config file'
falsepositives:
  - Scheduled configuration backups via FortiManager or automation — scope to known backup service accounts and windows
level: medium

// Hunt for post-exploitation behaviors on Fortinet appliances ingested via CEF/Syslog
// Scope to the window before and after KEV listing (2026-09-09)
let HuntStart = datetime(2026-08-01);
let HuntEnd = now();
CommonSecurityLog
| where TimeGenerated between (HuntStart .. HuntEnd)
| where DeviceVendor =~ "Fortinet"
| where DeviceEventClassID contains "event" or LogSeverity <= 4
| extend Msg = coalesce(Message, AdditionalExtensions)
| where Msg has_any ("added a new administrator", "login successfully", "backup", "download the configuration", "config file", "crash", "signal 11", "segmentation")
| project TimeGenerated, DeviceName, DeviceProduct, SourceIP, SourceUserName, Activity, Msg, LogSeverity
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, SourceIP, SourceUserName, Activity
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
   or Activity has_any ("admin", "backup")
| order by LastSeen desc;

-- Hunt endpoints for staging of tunneling tools and exfiltrated Fortinet
-- configuration files, a common post-exploitation pattern after edge
-- appliance compromise (CVE-2025-25249). Run against admin workstations
-- and jump hosts that manage network infrastructure.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)plink|chisel|ngrok|frpc|frps|ligolo|sshuttle|3proxy'
   OR CommandLine =~ '(?i)chisel|ligolo|reverse.*tunnel'

#!/bin/bash
# CVE-2025-25249 - Fortinet exposure verification and hardening helper
# Run from a management host with SSH access to your FortiGate fleet.
# Usage: ./forti_cve_2025_25249_check.sh <firewall_ip> <admin_user>

FW="$1"
USER="$2"

if [ -z "$FW" ] || [ -z "$USER" ]; then
  echo "Usage: $0 <firewall_ip> <admin_user>"
  exit 1
fi

echo "=== [1] Firmware version (compare against Fortinet PSIRT fixed builds) ==="
ssh -o StrictHostKeyChecking=accept-new "${USER}@${FW}" "get system status | grep -i version"

echo "=== [2] Local admin accounts (hunt for rogue/unknown admins) ==="
ssh "${USER}@${FW}" "show system admin | grep -i 'edit'"

echo "=== [3] Admin trusthost restrictions (should restrict mgmt to known IPs) ==="
ssh "${USER}@${FW}" "show system admin | grep -A 10 trusthost"

echo "=== [4] Interfaces with administrative access enabled (flag WAN-facing) ==="
ssh "${USER}@${FW}" "show system interface | grep -B 5 'set allowaccess'"

echo "=== [5] Recent admin login and config-change events ==="
ssh "${USER}@${FW}" "execute log filter category event
execute log filter field subtype system
execute log display | head -n 50"

echo ""
echo "REMEDIATION CHECKLIST:"
echo " 1. Upgrade to the fixed firmware build per the Fortinet PSIRT advisory for CVE-2025-25249"
echo " 2. Disable administrative access on all internet-facing interfaces"
echo " 3. Enforce trusthost ACLs limiting management to your admin subnet"
echo " 4. Enforce MFA on all admin accounts; rotate all local admin credentials"
echo " 5. Rotate VPN pre-shared keys and any credentials stored in the config if compromise is suspected"
echo " 6. Confirm logs are shipping to an external SIEM collector"

Remediation

Work through this in order. Do not skip the forensics step — with confirmed active exploitation, patching a compromised box without investigating it leaves the attacker inside.

1. Identify exposure immediately. Inventory every FortiOS, FortiSwitchManager, and FortiSASE asset. Determine whether the affected services are reachable from the internet (external scan or your ASM platform) and from internal segments.
2. Apply vendor mitigations. Follow the Fortinet PSIRT advisory for CVE-2025-25249 and upgrade to the fixed firmware builds for your release train. Pull the advisory directly from fortiguard.com/psirt and the CISA KEV entry. Meet the KEV due date — BOD 26-04 prioritization and CISA's Forensics Triage Requirements apply.
3. Forensic triage before and after patching. Per CISA's Forensics Triage Requirements, capture volatile evidence from internet-facing appliances before reboot/upgrade where feasible: running config, admin account list, active sessions, and recent event logs. If you find rogue admins, unexplained config exports, or logins from untrusted IPs, treat it as an incident, not a patch ticket.
4. Reduce the attack surface permanently. Administrative interfaces must never be reachable from the internet. Enforce trusthost restrictions, require MFA for all device administration, and segment management plane access.
5. Rotate secrets if compromise is possible. The device configuration contains credential material — local admin hashes, LDAP bind accounts, VPN pre-shared keys, RADIUS secrets. If the appliance was exposed and unpatched, rotate them all. Assume config exfiltration occurred.
6. FortiSASE tenants: Follow BOD 26-04 cloud service guidance — obtain written confirmation from Fortinet regarding remediation status of the cloud-delivered components you consume.
7. If no mitigation path exists for your asset, CISA's directive is to discontinue use. For most environments that means accelerating replacement of end-of-support hardware that cannot receive the fixed build.

Final Word

KEV additions for edge appliances are among the highest-signal alerts a vulnerability management program will ever receive. CVE-2025-25249 is not a patch-Tuesday item to queue behind change control for two weeks — it is an actively exploited code-execution flaw on the devices that define your perimeter. Patch, hunt, rotate, and verify your logging. If the hunt queries above return anything you can't explain with a change ticket, escalate to your IR retainer immediately.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub