Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2025-25249 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2025 |
| Date Published | 2026-09-09 |
| Vendor | Fortinet |
| Product | Multiple Products |
| CVSS Score | 8.1 (high) |
| EPSS Score | 2.4% (percentile: 83%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-12 |
Vulnerability Description
Source: CISA KEV
Fortinet FortiOS, FortiSwitchManager and FortiSASE contain a heap-based buffer overflow that allows an attacker to execute unauthorized code or commands via specially crafted packets.
A packet-borne vector means network reachability of the vulnerable service is enough for an attempt — no user interaction is required.
The scope is broader than the Fortinet product list suggests. The NVD CPE entry covers not only fortinet:fortios, fortinet:fortiswitchmanager and fortinet:fortisase but also siemens:ruggedcom_ape1808 — an application platform used in industrial environments, on which Fortinet software is sometimes hosted. Organisations with an OT footprint should check RUGGEDCOM APE1808 devices alongside conventional IT infrastructure.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-12 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running FortiOS, FortiSwitchManager or FortiSASE, and — per the CPE entry — the Siemens RUGGEDCOM APE1808 platform hosting Fortinet software.
Two places are easy to miss during inventory: edge devices outside the main data centre (branches, remote sites) and the IT/OT boundary. Industrial networks offer infrequent maintenance windows, so patching there needs its own schedule — and until then, network reachability of the vulnerable services should be restricted.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
