- Critical 9.8
- Known exploited (CISA KEV)
CVE-2025-25249
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
Scores
The facts
- Published
- 13 January 2026
- Last changed
- 7 October 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Affects
- fortinet fortios
- fortinet fortiswitchmanager
- fortinet fortisase
- siemens ruggedcom ape1808 firmware
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 9 September 2026.
- EPSS
- 3.8% chance of exploitation activity in the next 30 days (percentile 90).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.