Search: “capwap”

3 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 2 high 1 medium 0 low 0 info 0

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs3

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security NewsSep 8, 16:50 UTC · 8d agoExploit / PoC in the wildCVE-2025-252491

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackersSep 9, 08:57 UTC · 7d agoMalware in the wildCVE-2025-252492