CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon of Fortinet FortiOS, FortiSwitchManager and FortiSASE that lets a remote, unauthenticated attacker send specially crafted packets and execute unauthorized code or commands on the device, and it is confirmed present in the CISA KEV catalog even though Fortinet itself has not reported in-the-wild exploitation.
Vulnerability summary
9.8
Critical
3.7%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-01-13
Published
Vulnerability ID: CVE-2025-25249 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Fortinet FortiOS | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 6.4 all versions (migrate to a fixed release); 7.0.0 through 7.0.17 (fixed in 7.0.18); 7.2.0 through 7.2.11 (fixed in 7.2.12); 7.4.0 through 7.4.8 (fixed in 7.4.9); 7.6.0 through 7.6.3 (fixed in 7.6.4) |
| Fortinet FortiSwitchManager | cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:* | 7.0.0 through 7.0.5 (fixed in 7.0.6); 7.2.0 through 7.2.6 (fixed in 7.2.7) |
| Fortinet FortiSASE | cpe:2.3:a:fortinet:fortisase:*:*:*:*:*:*:*:* | Builds 25.1.39 and 25.1.51; remediated by Fortinet-managed upgrade per FG-IR-25-084 |
What this means
CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in the cw_acd daemon shared by Fortinet FortiOS, FortiSwitchManager and FortiSASE. NVD's description states the flaw "allows attacker to execute unauthorized code or commands via specially crafted packets" against FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, and all 6.4 builds, plus FortiSwitchManager 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5 (NVD).
NVD published its own Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. Fortinet's own CNA submission ([email protected]) scored the same flaw lower, at CVSS v3.1 8.1 with a High attack-complexity vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting Fortinet's assessment that ASLR and PIE protections meaningfully complicate exploitation; the 9.8 figure used here is NVD's own Primary metric, not Fortinet's (NVD).
Fortinet's PSIRT advisory FG-IR-25-084 lists fixed releases for every affected train — FortiOS 7.0.18, 7.2.12, 7.4.9 and 7.6.4; FortiSwitchManager 7.0.6 and 7.2.7; and remediated FortiSASE builds — and states Fortinet is not aware of exploitation in the wild as of its last update. As an interim mitigation short of upgrading, the advisory recommends removing "fabric" role access from untrusted interfaces and blocking CAPWAP-CONTROL (UDP ports 5246-5249) via local-in policies to limit reachability of the vulnerable daemon (Fortinet PSIRT Advisory FG-IR-25-084).
CISA added CVE-2025-25249 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-09, with a short required-action due date of 2026-09-12 and forensic-triage flagged "Yes" under BOD 26-04, even though known ransomware-campaign use is listed as "Unknown" and Fortinet's own advisory does not describe active exploitation — the KEV listing reflects CISA's independent risk assessment (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-31, FIRST scores the probability of exploitation at 0.0374 (89.84th percentile) (FIRST EPSS).
Because this is a KEV-listed flaw affecting multiple Fortinet product lines reachable over the fabric/CAPWAP interfaces, any FortiOS, FortiSwitchManager or FortiSASE deployment on an affected build should be patched to the fixed release or have the documented interface-level mitigations applied immediately.
Evidence
- Heap-based buffer overflow in the cw_acd daemon of FortiOS, FortiSwitchManager and FortiSASE allows a remote unauthenticated attacker to execute unauthorized code or commands via crafted packets. — NVD
- NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Fortinet's own CNA Secondary score is lower, 8.1, citing high attack complexity from ASLR/PIE. — NVD
- Fixed releases: FortiOS 7.0.18, 7.2.12, 7.4.9, 7.6.4 (6.4 must migrate); FortiSwitchManager 7.0.6, 7.2.7; affected FortiSASE builds remediated by Fortinet. No in-the-wild exploitation reported by Fortinet; interim mitigations are removing fabric access and blocking CAPWAP-CONTROL UDP 5246-5249. — Fortinet PSIRT Advisory FG-IR-25-084
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-09, due date 2026-09-12, forensic triage required under BOD 26-04; known ransomware campaign use listed as Unknown. Confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
- EPSS score is 0.0374 (89.84th percentile) as of 2026-10-31. — FIRST EPSS
