{"id":"fortinet-fortios-cw-acd-overflow-sep-2026","category":"patch","status":"closed","title":"Fortinet FortiOS and FortiSwitchManager heap overflow CVE-2025-25249 used in attacks; FortiOS 6.4 has no fix","tldr":"Fortinet FortiOS and FortiSwitchManager flaw CVE-2025-25249 is now used in attacks (CISA, 9 Sep 2026). Fixes exist for FortiOS 7.0 to 7.6 and FortiSwitchManager; FortiOS 6.4 has none. Update, or block UDP 5246-5249 from untrusted sources.","summary":"CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon, the part of Fortinet's FortiOS and FortiSwitchManager that handles CAPWAP wireless-controller traffic. Fortinet disclosed it on 13 January 2026 and says a remote attacker with no login could use specially crafted packets to run code. Fixed releases are FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, and FortiSwitchManager 7.2.7 and 7.0.6. FortiOS 6.4 has no fix and must be replaced with a supported branch. CISA added the flaw to its list of exploited vulnerabilities on 9 September 2026. A Triskele Labs bulletin citing SOCRadar reports attacks since at least July 2026, with over 30,000 FortiGate addresses targeted and 178 confirmed infections. Fortinet's advisory, last updated 23 February 2026, still says it is not exploited, so the attack reports come from CISA and those secondary sources. CISA also names FortiSASE; Fortinet's advisory as read does not list it. Severity differs: Fortinet gives 8.1 (High), NVD gives 9.8.","action":"If you run a FortiGate or FortiSwitchManager, upgrade to a fixed release (FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 or later; FortiSwitchManager 7.2.7 or 7.0.6 or later) and move off FortiOS 6.4. Until then, remove the \"fabric\" service from interface access settings or block UDP 5246 to 5249 from untrusted addresses, and ask your IT provider to check for signs of intrusion.","product":"Fortinet FortiOS and FortiSwitchManager (also FortiSASE per CISA)","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2025-25249"],"tags":["fortinet","fortios","fortiswitchmanager","firewall","cisa-kev","buffer-overflow","exploited","cve-2025-25249"],"affected":["FortiOS 7.6.0 through 7.6.3","FortiOS 7.4.0 through 7.4.8","FortiOS 7.2.0 through 7.2.11","FortiOS 7.0.0 through 7.0.17","FortiOS 6.4 (all versions)","FortiSwitchManager 7.2.0 through 7.2.6","FortiSwitchManager 7.0.0 through 7.0.5"],"fixed":["FortiOS 7.6.4 or later","FortiOS 7.4.9 or later","FortiOS 7.2.12 or later","FortiOS 7.0.18 or later","FortiSwitchManager 7.2.7 or later","FortiSwitchManager 7.0.6 or later"],"matches":[],"sources":[{"kind":"advisory","title":"Heap-based buffer overflow in cw_acd daemon (FG-IR-25-084)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","by":"Fortinet PSIRT","date":"2026-02-23"},{"kind":"news","title":"Critical Fortinet FortiOS remote code execution vulnerability under active exploitation (CVE-2025-25249)","url":"https://www.triskelelabs.com/resources/critical-fortinet-fortios-remote-code-execution-vulnerability-under-active-exploitation-cve-2025-25249","by":"Triskele Labs","date":"2026-09-09"}],"started":"2026-09-09","closed":"2026-09-09","created":"2026-11-03T22:08:16.213Z","updated":"2026-11-03T22:08:16.213Z","cve_notes":[{"cve":"CVE-2025-25249","name":"Heap overflow in FortiOS and FortiSwitchManager cw_acd","what":"A heap-based buffer overflow in cw_acd, the Fortinet daemon that handles CAPWAP wireless-controller traffic, that a remote attacker with no login could trigger with crafted packets to run code on the device.","severity":"high","cvss":8.1}],"timeline":[{"at":"2026-09-09","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2025-25249 to its list of flaws used in attacks, with a remediation deadline of 12 September 2026. A Triskele Labs bulletin citing SOCRadar says exploitation has been confirmed since at least July 2026, with over 30,000 FortiGate addresses targeted and 178 confirmed infections.","url":"https://www.triskelelabs.com/resources/critical-fortinet-fortios-remote-code-execution-vulnerability-under-active-exploitation-cve-2025-25249","by":"Triskele Labs","patch":null},{"at":"2026-02-23","added":"2026-11-03T22:05:25.250Z","kind":"vendor-revised","text":"Fortinet updated the advisory and removed FortiOS 6.4.17 from the fixed versions. FortiOS 6.4 now has no fixed release and customers must move to a supported branch.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","by":"Fortinet PSIRT","patch":"partial"},{"at":"2026-01-13","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"Fortinet published advisory FG-IR-25-084: a heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager that a remote, unauthenticated attacker could use to run code. Fixes were FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, and FortiSwitchManager 7.2.7 and 7.0.6; Fortinet then listed it as not exploited.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","by":"Fortinet PSIRT","patch":"partial"}],"url":"https://hard.fyi/live/fortinet-fortios-cw-acd-overflow-sep-2026/","json":"https://hard.fyi/api/live?id=fortinet-fortios-cw-acd-overflow-sep-2026"}