Fortinet's January Patch Isn't Stopping an AI-Built RAT

Attackers are using a heap-based buffer overflow in FortiOS that Fortinet patched in January to install PivotC2, a backdoor SOCRadar believes was built with AI, on FortiGate firewalls since at least July.

The vulnerability, CVE-2025-25249, lets a remote attacker execute code with no credentials and no user interaction, according to Fortinet's own description, which SecurityWeek quoted directly: the bug "may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests."

A heap overflow in the CAPWAP daemon

The flaw sits in cw_acd, the daemon that handles CAPWAP, the protocol FortiOS uses to control and provision wireless access points, on UDP port 5246. Triskele Labs, citing SOCRadar's technical analysis, described a three-step chain: an attacker first leaks memory pointers with a CAPWAP Discovery Request to defeat address space layout randomization, then grooms the heap with crafted CAPWAP Add Station messages, then triggers the overflow with a weaponized CAPWAP Image Data message that hijacks control flow and spawns a Node.js reverse shell.

A score Fortinet and NVD do not agree on

Fortinet rates CVE-2025-25249 at 7.3 to 7.4 on the CVSS scale. The National Vulnerability Database lists it as 9.8, Critical. Fortinet shipped fixed builds in August 2025, Arctic Wolf said, months before the company published its advisory, FG-IR-25-084, on Jan. 13, 2026. SOCRadar's earliest confirmed exploitation dates to July 2026, eleven months after a fix already existed and about six months after the public advisory.

178 devices, and a RAT SOCRadar says was built with AI

SecurityWeek reported that SOCRadar counted more than 30,000 IP addresses targeted and 178 devices compromised with PivotC2, a Node.js-based remote access trojan purpose-built as a FortiGate post-exploitation tool, giving attackers an interactive shell, network scanning, traffic tunneling and configuration harvesting. SOCRadar said it believes PivotC2 was developed with AI assistance, without detailing how it reached that conclusion. The campaign has focused on United States targets, with at least two intrusions resulting in data exfiltration, and SecurityWeek attributed the activity to a Russian-speaking cybercrime actor, a different profile from the state actors CISA's catalog more often names.

A three-day patch window, two months late

CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog Sept. 9 and set a Sept. 12 deadline for federal civilian agencies, a three-day window under Binding Operational Directive 26-04 that is short even by the agency's own standard. By that deadline, confirmed exploitation had already run for roughly two months, and a fix had existed for more than a year. Fortinet's patched releases are FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 and 6.4.17, and FortiSwitchManager 7.2.7 and 7.0.6; FortiSASE customers on the affected 25.1.a build need to migrate to a fixed release rather than patch in place.

The gap between a fix existing and a network appliance getting exploited anyway is not unique to Fortinet this month. CISA's catalog also gained an authentication-bypass bug in Cisco's Firewall Management Center, tied to state and ransomware-affiliate activity, and an ICS advisory for a satellite terminal that CISA upgraded in severity after publication. FortiGate administrators who have not applied the January builds remain exposed regardless of Sept. 12's federal-only deadline.

Date	Event
Aug. 2025	Fortinet ships fixed builds
Jan. 13, 2026	Public advisory FG-IR-25-084
July 2026	SOCRadar's earliest confirmed PivotC2 activity
Sept. 9, 2026	CISA adds CVE-2025-25249 to KEV
Sept. 12, 2026	Federal patch deadline