PivotC2 RAT exploits CVE-2025-25249, a Fortinet heap overflow patched since January

January 2026. Fortinet publishes CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon of FortiOS, and ships the fixes at the same time. September 9, 2026. The CISA adds the flaw to its KEV catalog: exploitation is now confirmed in the wild. September 12, 2026. That is the deadline imposed on US federal agencies. In between, threat-intelligence firm SOCRadar tracked a campaign targeting more than 30,000 IP addresses, infecting 178 devices with PivotC2, a RAT purpose-built for FortiGate boxes. The story is not the bug itself — it is what the bug says about fleets that never patched a CVSS 9.8 flaw on hardware exposed over CAPWAP.

A heap overflow in a daemon nobody watches

CVE-2025-25249 is a heap-based buffer overflow (CWE-122 / CWE-787) in the cw_acd daemon, the CAPWAP (Wireless Aggregate Controller) service of FortiOS and FortiSwitchManager. This is the component that handles CAPWAP control traffic, listening on UDP port 5246, used by Fortinet Security Fabric and the wireless-controller functions.

The problem with this component is where it sits: it is often reachable from the outside on exposed FortiGate appliances, without the visibility of a web service or a VPN endpoint. An unauthenticated, remote attacker sends specially crafted packets to trigger the overflow and execute arbitrary code — no credentials, no user interaction.

Severity is even contested on paper: the NVD scores it CVSS 9.8 critical, Fortinet scores it 7.4 high. The gap comes down to a nuance Fortinet flags in its FG-IR-25-084 advisory: enabling mitigations like ASLR and PIE significantly raises the effort required to exploit it. The operational takeaway is unchanged — a bug exploitable without authentication on a perimeter must be handled at the ceiling, not at the average of two scores.

PivotC2, a RAT written for FortiGate boxes

The observed exploitation does not stop at a shell. Attackers deploy PivotC2, a Node.js RAT designed specifically for FortiGate appliances. SOCRadar flags one telling detail: the detailed inline comments and code structure suggest its developers leaned on AI-assisted code generation.

The attack chain is direct. The attacker locates an exposed FortiGate with UDP 5246 open, sends crafted packets, obtains a reverse shell, then runs a one-line JavaScript stager via Node.js. The stager fetches the second-stage payload, Base64-decodes it, XOR-decrypts it, and writes it to a temporary file. PivotC2 then runs as a detached background process, surviving the initial connection closing.

The RAT’s capabilities make it a full post-exploitation toolkit:

• Interactive shell via /bin/sh, bash, ash, dash, or busybox;
• File upload and download with streaming support;
• SOCKS5 and HTTP tunneling, plus local and remote port forwarding;
• Network scanning across CIDR ranges and ports;
• FortiGate configuration harvesting and credential decryption (AES-256-CBC, AES-128-GCM): VPN pre-shared keys, SSL-VPN credentials, Wi-Fi passwords, administrator accounts;
• Auto-mode for hands-off compromise at scale.

In confirmed intrusions, attackers exfiltrated Microsoft Exchange mailboxes to cloud storage after using the compromised FortiGate as a pivot point into the internal network. A firewall, in this scenario, is not the end target — it is the front door. That framing matters for defense too: a firewall is not a box to keep patched, it is an asset to keep under watch.

A January bug that lingered until September

The timeline is the most instructive part. Fortinet found the flaw internally — its Product Security team — and shipped fixes in January 2026: FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18, and 6.4.17, plus FortiSwitchManager 7.2.7 and 7.0.6. Eight months later, the CISA adds it to the KEV — which, by definition, requires evidence of exploitation.

FortiGate appliances are not an incidental target either. They sit at the network edge, terminate SSL-VPN sessions, and hold the keys to the internal network — which is why a purpose-built RAT, rather than a generic shell, made economic sense for the operators. A compromised firewall is not a single asset; it is a vantage point over everything behind it.

That gap is a weak signal turned strong. A critical bug fixed in January that resurfaces exploited in September means whole fleets never applied the patch, or that forgotten appliances — lab boxes, standby units, subsidiary sites — remain online on vulnerable versions. That is exactly the kind of asset an automated 30,000-IP campaign eventually finds.

What network teams should do

The order of operations is simple, and it starts with inventory:

• Inventory exact releases across every FortiGate/FortiOS, FortiSwitchManager, and FortiSASE instance — including lab boxes and standby HA pairs;
• Upgrade to the fixed floor or later: 7.6.4+, 7.4.9+, 7.2.12+, 7.0.18+, 6.4.17+; FortiSwitchManager 7.2.7+ and 7.0.6+;
• Remove fabric access from interfaces that do not need it, by dropping the fabric keyword from the allowaccess directive;
• Restrict CAPWAP (UDP 5246-5249) to trusted devices only via a local-in policy, where Security Fabric must remain active;
• Hunt for PivotC2 indicators: unexpected Node.js processes, outbound connections to unusual servers, untracked configuration changes.

A minimal configuration snippet to remove fabric access from an interface:

config system interface
    edit "port1"
        set allowaccess ssh https
    next
end

Previously allowaccess contained fabric ssh https: dropping fabric cuts access to the vulnerable CAPWAP path without touching the administrative services you still need. Siemens repeated the same guidance in its SSA-864900 bulletin for systems that embed Fortinet software.

Hunting PivotC2 before you conclude

The fix prevents future exploitation; it does not clean a device that was already hit. Fortinet and SOCRadar converge on one instruction: a box that was reachable on the vulnerable path must be treated as suspect until proven otherwise.

The hunt focuses on three signals:

• Unexpected Node.js processes: PivotC2 runs on Node.js — look for node or nodejs processes that do not belong to a known application;
• Unusual outbound connections: the RAT keeps a command channel to an attacker-controlled server, often on non-standard ports;
• Temporary files and stagers: the stager writes a Base64 then XOR payload to a temporary file before launching the RAT as a detached process.

One point SOCRadar stresses: the RAT harvests and decrypts FortiGate configurations, including VPN keys and administrator accounts. A compromised device is not repaired by patching it — you must revoke the secrets it carried and, in the worst case, rebuild it from clean media.

Verdict

CVE-2025-25249 is not a new disclosure: it is a CVSS 9.8 heap overflow patched since January 2026, resurfacing in September as an automated campaign dropping PivotC2, a purpose-built RAT for FortiGate boxes. The lesson lives in the lag — a critical bug on an obscure network path, CAPWAP, stays invisible until you treat it as exposed surface.

If you run FortiGate or FortiSwitchManager, upgrade now, then remove unnecessary fabric access and restrict CAPWAP to trusted peers. The fix has existed for eight months: the observed exploitation of 178 devices is not a theoretical warning.

If you cannot patch immediately, at minimum cut fabric access and UDP 5246 from the outside — but treat that as a stopgap, not closure. The only real closure is the upgrade, paired with a hunt for compromise indicators.

References

• Fortinet PSIRT — FG-IR-25-084 (CVE-2025-25249)
• CISA — Known Exploited Vulnerabilities Catalog
• NIST NVD — CVE-2025-25249
• Cyber Security News — Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js RAT (SOCRadar STRU), September 2026
• ThreatAft — Fortinet CVE-2025-25249, PivotC2 RAT RCE, September 2026
• Siemens ProductCERT — SSA-864900