Warning: RCE vulnerability in Fortinet FortiOS and FortiSwitchManager. Patch Immediately!

    * Last update:  16/01/2026
   
    * Affected products:
         →Fortinet FortiOS and FortiSwitchManager

    * Type: Heap-based Buffer Overflow

    * CVE/CVSS:

• CVE-2025-25249: CVSS CRITICAL (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Sources

Fortinet - https://fortiguard.fortinet.com/psirt/FG-IR-25-084

Risks

Exploitation allows an attacker to execute unauthorized code or commands via specially crafted packets.

A vulnerable instance that is publicly available over the internet can be at risk of a high impact on the confidentiality, integrity and availability.

Description

A heap-based buffer overflow vulnerability exists in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4.0 through 6.4.16, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5.

Recommended Actions

Patch 
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

More information on the vendor’s website: https://fortiguard.fortinet.com/psirt/FG-IR-25-084

Monitor/Detect 
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via https://ccb.belgium.be/cert/report-incident.

While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.