CVE-2025-25249 (CVSS 9.8): PivotC2 RAT Is Actively Backdooring FortiGate Firewalls — Patch FortiOS Now

Your FortiGate firewall is supposed to be the first and last line of defence between your organisation and the internet. But since at least July 2026, a financially motivated, Russian-speaking threat actor has been using that very device as a beachhead — silently installing a full-featured remote-access trojan called PivotC2 on vulnerable FortiOS and FortiSwitchManager deployments worldwide. On September 9, 2026, CISA formally confirmed the exploitation by adding CVE-2025-25249 to its Known Exploited Vulnerabilities (KEV) catalog. If your team has not already patched or mitigated this flaw, the question is no longer if you are targeted — it is whether the attacker is already inside.

What Is CVE-2025-25249 and Why Is It So Dangerous?

CVE-2025-25249 was first disclosed by Fortinet in January 2026 (PSIRT advisory FG-IR-25-084) as a heap-based buffer overflow in the cw_acd daemon — the process that handles CAPWAP (Control and Provisioning of Wireless Access Points) traffic. Fortinet uses CAPWAP to let FortiGate firewalls centrally manage wireless access points across the Security Fabric. The daemon listens on UDP port 5246 for incoming control traffic.

A remote, unauthenticated attacker can send specially crafted CAPWAP packets that overwrite adjacent heap memory, redirecting execution flow to attacker-controlled shellcode. Because cw_acd runs in the context of the FortiOS kernel, a successful exploit grants arbitrary code execution at the operating-system level — there is no further privilege escalation needed. This is as bad as it gets for a network edge device.

NVD’s independent assessment assigns this vulnerability a CVSS Base Score of 9.8 (Critical). Fortinet’s initial internal CVSS was lower, but the combination of network-accessible attack vector, no authentication requirement, and no user interaction needed drove NVD’s score to near-maximum.

Affected Products and Fixed Versions

Product	Vulnerable Versions	Fixed Version
FortiOS 7.6	7.6.0 – 7.6.3	7.6.4+
FortiOS 7.4	7.4.0 – 7.4.8	7.4.9+
FortiOS 7.2	7.2.0 – 7.2.11	7.2.12+
FortiOS 7.0	7.0.0 – 7.0.17	7.0.18+
FortiOS 6.4	6.4.x (all)	6.4.17+
FortiSwitchManager 7.2	7.2.0 – 7.2.6	7.2.7+
FortiSwitchManager 7.0	7.0.0 – 7.0.5	7.0.6+

Source: Fortinet PSIRT advisory FG-IR-25-084

Meet PivotC2: The FortiGate Post-Exploitation RAT

What separates this campaign from a run-of-the-mill exploit is the sophistication of the post-exploitation payload. PivotC2 is a purpose-built, Node.js-based Remote Access Trojan designed specifically for FortiGate environments. SOCRadar’s Threat Research Unit, which published its analysis on September 8, 2026, assessed with high confidence that a Russian-speaking, financially motivated threat actor is behind the campaign based on Russian-language inline code comments and the specific intelligence targets chosen.

Once deployed — typically staged via /tmp/.i.js — PivotC2 delivers an alarming breadth of attacker capability:

• Interactive shell access — full command execution on the FortiGate OS
• FortiGate-specific credential harvesting and decryption — extracting VPN credentials, SSL-VPN user accounts, LDAP bind passwords, and wireless PSKs from the running configuration
• SOCKS5 and HTTP proxy tunnelling — routing attacker traffic through your FortiGate into your internal network, evading outbound security controls
• Port forwarding and CIDR-range network scanning — enumerating live hosts, open ports, and services on your LAN and OT segments
• File upload, download, and directory traversal — exfiltrating configurations, certificate bundles, logs
• Autonomous operation mode — PivotC2 supports an auto-flag for hands-off exploitation after initial access

The actor’s infrastructure communicates over HTTPS on non-standard ports: confirmed C2 servers include 146.103.99[.]177:8443 and 46.151.29[.]58:8443 (defanged for safety). The threat actor has shown interest in pivoting further to FortiManager, PeopleSoft, and ArubaOS environments in compromised organisations, suggesting a deliberate strategy of network-wide lateral movement.

Exploitation Scale: What the Numbers Say

By early September 2026, SOCRadar’s telemetry had recorded 30,000+ FortiGate IP addresses actively scanned by the campaign’s reconnaissance infrastructure. Of these, 178 confirmed PivotC2 sessions had been established — meaning the attacker already has live, interactive RAT sessions on 178 FortiGate devices. Two US-based organisations have experienced complete network compromise with confirmed data exfiltration. Given how long the campaign has been running since July, the true number of compromised devices is almost certainly higher.

For India-based organisations: FortiGate is the firewall of choice across large swaths of Indian banking, telecom, manufacturing, and government infrastructure. If your FortiOS version falls in the vulnerable ranges above and your CAPWAP port is reachable — even from your ISP’s network — you must assume you are in scope for this campaign.

What You Should Do Right Now — Sanjay Seth’s Expert Guidance

Having deployed and managed FortiGate infrastructure across hundreds of enterprise and government environments in India and the region, here is what I recommend, ordered by urgency:

1. Patch immediately. Log in to the Fortinet Support Portal, download the appropriate FortiOS or FortiSwitchManager build for your hardware, and schedule an emergency maintenance window — tonight if possible. FortiOS upgrades on most mid-range and enterprise FortiGate models complete in under 15 minutes with minimal downtime using HA failover.
2. If you cannot patch immediately, restrict CAPWAP now. In FortiOS CLI, apply a local-in policy to drop inbound UDP traffic on ports 5246–5249 from all sources except your trusted wireless controller IPs. If you do not manage wireless APs through this FortiGate, disable the fabric-device daemon entirely on all external interfaces:

   config system interface
  edit "wan1"
    set allowaccess ping https ssh
    # Remove 'fabric' from allowaccess
  next
end

3. Run a forensic sweep before and after patching. Check for the staging file /tmp/.i.js and any unexpected Node.js processes in the FortiOS shell. Review session logs and outbound connections for the known C2 IPs above.
4. Rotate all credentials. If you are on a vulnerable version and your CAPWAP port was exposed, treat the full configuration as compromised. Rotate every credential the FortiGate knows: VPN user passwords, SSL-VPN accounts, LDAP/AD bind accounts, RADIUS shared secrets, Wi-Fi PSKs, and FortiGate admin accounts. Do not wait to confirm infection before rotating — the cost of rotating is trivial compared to the cost of an attacker retaining valid VPN access to your network.
5. Apply a zero-trust segmentation review. PivotC2 specifically enables network pivoting via SOCKS5 tunnelling. If your internal segments are flat or your firewall only enforces north-south policies, a compromised perimeter device becomes a free pass to every internal host. This is the moment to audit and enforce east-west micro-segmentation on your FortiGate SD-WAN and Security Fabric policies.
6. Subscribe to Fortinet PSIRT alerts. Future advisories land at fortiguard.com/psirt. If you are not subscribed, you are always reacting instead of anticipating.

The Broader Pattern: Perimeter Devices as Preferred Initial Access Vectors

CVE-2025-25249 is not an isolated incident. In recent months, we have seen major, actively exploited RCE and authentication bypass vulnerabilities in Citrix NetScaler (CVE-2026-19490), SonicWall SMA 1000, PaperCut, OpenVPN, and now Fortinet — all perimeter devices that organisations trust to protect them. The pattern is consistent: attackers prioritise pre-authentication, network-accessible flaws in security infrastructure because these devices are simultaneously the most powerful and the least frequently rebooted or patched assets in an organisation.

The CISA KEV catalog now carries CVE-2025-25249 with a federal patching deadline. While Indian enterprises are not bound by CISA mandates, the KEV addition is the industry’s clearest signal that a vulnerability is being actively weaponised at scale. Treat it accordingly.

For additional technical context, the NVD entry for CVE-2025-25249 and SOCRadar’s detailed PivotC2 threat analysis are essential reading for your security team.

Frequently Asked Questions

My FortiGate does not manage any wireless access points. Am I still vulnerable?

Yes. The cw_acd daemon that processes CAPWAP traffic runs on FortiOS regardless of whether you have wireless APs configured. The vulnerability exists at the daemon level, not the configuration level. Unless you have already disabled the fabric-device service and blocked UDP 5246–5249, you are exposed on vulnerable versions.

How do I know if my FortiGate was compromised before I patched?

Check for the file /tmp/.i.js via the FortiOS CLI (diagnose sys shell, then ls /tmp/). Look for any running Node.js processes (diagnose sys process list). Review your FortiGate’s session table and DNS resolution logs for outbound connections to the known C2 IPs: 146.103.99.177 and 46.151.29.58. Also review FortiAnalyzer or syslog exports for anomalous admin logins or configuration changes. If you find any of these indicators, treat it as a confirmed breach and engage your incident response team immediately.

Will upgrading FortiOS remove PivotC2 if it is already installed?

A standard in-place FortiOS upgrade will overwrite most system files, but do not rely on a patch to clean an active infection. PivotC2’s autonomous mode and potential persistence mechanisms may survive across certain upgrade paths. The correct sequence is: (1) isolate the device from upstream networks, (2) perform forensic imaging if required, (3) do a factory reset and apply a clean firmware build from scratch, (4) restore configuration from a known-good backup (pre-July 2026 if possible), and (5) rotate all credentials. Skipping the factory reset on a confirmed compromise is a common and costly mistake.

Is there a temporary mitigation I can apply without a maintenance window?

Yes. Apply a local-in policy via FortiOS CLI to drop inbound UDP traffic on ports 5246 and 5247 from all untrusted sources. This can be done without a reboot and takes effect immediately. Additionally, remove fabric from the allowaccess parameter on all WAN-facing interfaces. These steps do not fix the underlying vulnerability but eliminate the external attack surface until you can schedule the firmware upgrade. Coordinate with Fortinet TAC if you need guidance specific to your hardware model and FortiOS branch.