Executive Summary
A critical vulnerability, CVE-2025-25249 (CVSS 9.8), is currently being exploited in the wild against Fortinet appliances, including FortiOS, FortiSwitchManager, and FortiSASE. The flaw is a heap-based buffer overflow in the `cw_acd` daemon, which processes Control And Provisioning of Wireless Access Points (CAPWAP) traffic. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 9, 2026, after evidence of active exploitation emerged.
Technical analysis indicates that attackers use an exploit framework known as `fortirun.bin` to fingerprint devices and gain remote code execution (RCE). Once access is established, they deploy PivotC2, a Node.js-based post-exploitation framework specifically designed for FortiGate environments. This tool enables persistent outbound C2 connections, credential harvesting, and network tunneling, turning the compromised firewall into a pivot point for internal lateral movement.
This threat is high-impact because firewalls occupy privileged positions on the network perimeter. Organizations using affected Fortinet products should prioritize immediate patching to the recommended firmware versions. Furthermore, because exploitation has been traced back to at least July 2026, forensic triage is required for any system that was internet-exposed while vulnerable during that window.