Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.
SOCRadar reports exploitation of an unauthenticated remote code execution vulnerability, CVE-2025-25249 (CVSS 7.4), patched in January in FortiOS and FortiSwitchManager. Attackers scanned over 30,000 IP addresses, infected 178 devices with PivotC2 RAT, and at least two intrusions resulted in data exfiltration, primarily targeting US entities. SOCRadar attributes attacks to a likely Russian-speaking cybercrime actor and suggests the RAT was AI-assisted, in use since July 2026. CISA added the CVE to the KEV catalog with a three-day BOD 26-04 patch deadline for federal agencies.
- CVE-2025-25249 (CVSS 7.4) is a heap-based buffer overflow allowing unauthenticated RCE
- 178 devices infected with PivotC2 RAT after 30,000+ IP addresses targeted
- Two US intrusions confirmed with data exfiltration
- CISA added CVE to KEV with three-day federal patch deadline
- Patch available in FortiOS 7.6.4/7.4.9/7.2.12/7.0.18 and FortiSwitchManager 7.2.7/7.0.6
- CVEs
- CVE-2025-25249
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1098 Account ManipulationT1046 Network Service ScanningT1041 Exfiltration Over C2 Channel
- Vendors
- Fortinet
- Threat actors
- Russian-speaking cybercrime actor
- Malware
- PivotC2
- Victims
- US entities
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-25249 | Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE | 9.8 | 4% | KEVPoC | KEV |
From the original article
1 min read at securityweek.com
The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026. The post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.