SOCRadar (8 September 2026, 13:00 Turkey time; 6:00 pm Perth) reports active exploitation of CVE-2025-25249, a heap-based buffer overflow in the FortiOS / FortiSwitchManager cw_acd CAPWAP daemon (UDP 5246), delivering PivotC2 — a Node.js post-exploitation RAT for FortiGate with interactive shell, tunnelling, scanning and config/credential harvesting. SOCRadar cites NVD's CVSS 3.1 score of 9.8. Per SOCRadar: exploitation since at least July 2026; more than 30,000 IP addresses targeted and 178 of them confirmed exploited and infected with PivotC2, with the highest concentration in the US, where two full intrusions resulted in confirmed data exfiltration; tradecraft assessed with high confidence as Russian-speaking cybercrime; the actor highly likely used AI to develop the RAT.

Affected per SOCRadar: FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17 and all 6.4 versions; FortiSwitchManager 7.2.0–7.2.6 and 7.0.0–7.0.5. Fixed: FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18; FortiSwitchManager 7.2.7 / 7.0.6.

Fortinet's advisory FG-IR-25-084 (published 13 January 2026, updated 23 February 2026) lists the same affected and fixed versions, tells FortiOS 6.4 users to migrate to a fixed release, and rates the flaw CVSSv3 8.1 (High); Fortinet's CVE record uses high attack complexity (AC:H), lower than NVD's 9.8. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 9 September 2026 (per NVD and the CVE record). (sources: SOCRadar; Fortinet advisory FG-IR-25-084; NVD; Fortinet)

Correction (26 Oct 2026): removed the SecurityWeek credit and link; every fact is now credited to SOCRadar, NVD or Fortinet's CVE record, and FortiOS 6.4 has been added to the affected versions.

The card date has moved from 10 to 8 September 2026, the Perth date of SOCRadar's report (8 September, 10:00 UTC; 6:00 pm Perth time (AWST)), the earliest report of this exploitation cited. (source: SOCRadar)

Correction (26 Oct 2026): affected versions, fixed versions and Fortinet's CVSSv3 8.1 rating are now cited directly to Fortinet's advisory FG-IR-25-084. (source: Fortinet)