The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Fortinet vulnerability, tracked as CVE-2025-25249, to its Known Exploited Vulnerabilities catalog after confirming evidence of active exploitation.
The flaw affects FortiOS, FortiSwitchManager, and FortiSASE products. It could allow attackers to execute unauthorized code or commands by sending specially crafted packets.
CVE-2025-25249 is a heap-based buffer overflow vulnerability. A heap overflow occurs when an application writes more data into a memory area than it was designed to hold.
This can corrupt adjacent memory and potentially let an attacker alter program behavior, crash a device, or run malicious code with the privileges of the affected service. The issue is associated with CWE-122, heap-based buffer overflow, and CWE-787, out-of-bounds write.
Fortinet security appliances are commonly deployed at enterprise network boundaries, making FortiOS vulnerabilities especially significant.
A successful compromise of an internet-facing firewall, secure access service edge platform, or network-management tool could provide attackers with a foothold for further intrusion activity.
Fortinet Heap-based Buffer Overflow Flaw Exploited
Depending on the deployment, threat actors may attempt to steal credentials, change configurations, establish persistence, or move deeper into internal networks. CISA added the vulnerability to the KEV catalog on September 9, 2026, and set a remediation due date of September 12, 2026.
Federal civilian executive branch agencies must apply vendor-provided mitigations under Binding Operational Directive 26-04, which prioritizes security updates according to exploitation risk.
The agency also requires forensic triage for affected environments, indicating that organizations should investigate for possible compromise rather than treating the issue as a routine patching event.
CISA stated that organizations should follow Fortinet’s mitigation guidance and assess every affected asset for internet exposure. Where a cloud service is involved, stakeholders should follow applicable BOD 26-04 cloud-service guidance.
If no mitigation is available, CISA advises organizations to stop using the affected product. Security teams should identify all FortiOS, FortiSwitchManager, and FortiSASE deployments, prioritizing systems exposed to the public internet.
Administrators should apply the relevant Fortinet fixes or mitigations, review logs for suspicious traffic involving crafted packets, and check for unexpected configuration changes, administrative accounts, VPN activity, or outbound connections.
While CISA has confirmed exploitation, the agency currently lists ransomware use as unknown. Organizations should nevertheless treat the vulnerability as an active intrusion risk and conduct incident-response triage after remediation.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks appeared first on Cyber Security News.