CVE-2025-25249:
Critical heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiSwitchManager allows remote code execution.
Score
A numerical rating that indicates how dangerous this vulnerability is.
9.8Critical- Published Date:Jan 13, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.0
- EPSS Percentile:2%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.9
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
Critical heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiSwitchManager allows remote code execution.
Overview
The vulnerability (CVE-2025-25249) is a heap-based buffer overflow that affects Fortinet's FortiOS and FortiSwitchManager products. It has been assigned a CVSS v3.1 base score of 9.8 (Critical) by NIST, indicating its severe nature. The flaw requires no user interaction or privileges to exploit, can be attacked from the network, and has a low attack complexity. Successful exploitation could lead to a complete compromise of the system's confidentiality, integrity, and availability. The vulnerability stems from improper buffer management, classified as CWE-787 (Out-of-bounds Write) by NIST.
Remediation
- To mitigate this vulnerability, users should immediately update their Fortinet products to the latest available versions. Specifically:
- For FortiOS:
- Update to version 7.6.4 or later for the 7.6.x branch
- Update to version 7.4.9 or later for the 7.4.x branch
- Update to version 7.2.12 or later for the 7.2.x branch
- Update to version 7.0.18 or later for the 7.0.x branch
- Update to version 6.4.17 or later for the 6.4.x branch
- For FortiSwitchManager:
- Update to version 7.2.7 or later for the 7.2.x branch
- Update to version 7.0.6 or later for the 7.0.x branch
- Additionally, users should review and implement Fortinet's security best practices, including network segmentation and restricting access to management interfaces.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
