60
60
60
60
60
60
60
60
60
45
60
60
60
60
60
60
60
CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks
CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.
CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) allowing unauthorized code execution by sending specially crafted packets. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 remediation deadline for federal agencies under BOD 26-04 and mandatory forensic triage of affected environments. Internet-facing Fortinet firewalls and SASE platforms are a likely foothold for credential theft, persistence, and lateral movement; ransomware use is currently listed as unknown.
85
60
60
60
60
New Fortinet and Ivanti Zero Days Exploited in the Wild
60
60
60
60
60
Critical Fortinet FortiOS flaw exploited in the wild (CVE-2024-21762)
60
60
60
60
60
60
60
60
60
60
60
Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation
60
60