Fortinet Heap-based Buffer Overflow Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2025-25249, a heap-based buffer overflow vulnerability in Fortinet FortiOS, FortiSwitchManager, and FortiSASE, to the Known Exploited Vulnerabilities Catalog on 9 September 2026 (catalog version 2026.10.21). The vulnerability allows an attacker to execute unauthorized code or commands via specially crafted packets, and is recorded under CWE-122 and CWE-787. CISA's remediation due date for federal civilian agencies is 12 September 2026. The CVE record names no fixed version: FortiSwitchManager is affected through 7.2.5 and FortiOS through 7.6.2. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.038 probability of exploitation (90th percentile, 23 October 2026). CISA's ADP records SSVC exploitation as active, automatable as no, and impact as total. Fortinet advisory FG-IR-25-084 applies.

Assessment

For a platform or AI-stack owner, the record lets you check whether any FortiOS, FortiSwitchManager, or FortiSASE instance in your estate runs a version at or below the affected lines — FortiOS through 7.6.2 and FortiSwitchManager through 7.2.5 — and, because the CVE record names no fixed version, decide whether to isolate affected appliances or follow the vendor advisory FG-IR-25-084 for mitigations. The record's active-exploitation SSVC marking supports treating this as a patch-or-isolate decision rather than a monitor-and-wait one.

For a cyber underwriter, the record lets you check a policyholder's Fortinet estate against the affected version lines and the absence of a named fixed version, and decide whether to require a control or price the exposure accordingly. The catalog's active-exploitation marking and total-impact SSVC rating give you a basis for asking whether the policyholder has applied the vendor's mitigations before binding or renewing.

What would change this call

A named fixed version in the CVE record, or a change in the catalog's ransomware or exploitation fields, would change the patch-versus-isolate and pricing decisions above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 9 September 2026.

Sources

[1] Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2025-25249

[2] CVE record CVE-2025-25249 — https://www.cve.org/CVERecord?id=CVE-2025-25249

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog