Patched in January 2026, the CVE-2025-25249 heap overflow in the FortiOS cw_acd daemon has resurfaced exploited in the wild: CISA added it to the KEV catalog on September 9, 2026, after SOCRadar observed the PivotC2 RAT deployed on 178 devices. Network teams must upgrade exposed FortiOS trains before September 12, then strip out unnecessary fabric access.

On August 13, 2026 Fortinet shipped eight fixes, including a FortiWeb authentication bypass that lets an attacker log in with random credentials and a FortiManager flaw that allows impersonating a FortiGate. Teams running a firewall fleet should treat these two as top-priority patches.