CVE-2025-25249 patch decisions are urgent because current CISA-derived Known Exploited Vulnerabilities records identify the Fortinet flaw as known exploited. If your organisation operates an affected Fortinet product, identify the exact product and software branch, move to the appropriate fixed or remediated release, and separately assess whether exploitation may have occurred before remediation.
Direct answer: current KEV-derived records show CVE-2025-25249 entered the known-exploitation state on September 9, 2026. Fortinet documentation confirms FortiOS fixes in 7.0.18, 7.2.12, 7.4.9 and 7.6.4. Current Fortinet CNA data also lists FortiSwitchManager 7.0.6 and 7.2.7 as fixed branches and states that FortiSASE was remediated in 25.1.b and 25.2.c. Patching or moving to the appropriate remediated version closes the documented vulnerable software state, but it does not prove the device or service was never exploited before remediation.
Why CVE-2025-25249 is urgent
CVE-2025-25249 was already a disclosed Fortinet vulnerability with fixes available. The important current state is that exploitation in the wild is now part of the evidence. That changes the administrator’s task from simply checking whether a patch exists to verifying exposure, completing remediation and considering whether post-exploitation review is necessary.
Current CVE and KEV-derived records describe CVE-2025-25249 as a heap-based buffer overflow affecting Fortinet products and capable of allowing unauthorised code or command execution through crafted network traffic. Organisations should not treat an affected deployment as a routine future maintenance item.
Which FortiOS versions are confirmed fixed?
Fortinet’s release notes directly identify several FortiOS releases as no longer vulnerable to CVE-2025-25249. The fixed releases verified for the reviewed branches are:
- FortiOS 7.0.18 or later in the appropriate supported upgrade path
- FortiOS 7.2.12 or later
- FortiOS 7.4.9 or later
- FortiOS 7.6.4 or later
Current vendor CVE data also identifies FortiOS 6.4 as affected without listing a fixed 6.4 release. Administrators on older or unsupported branches should follow Fortinet’s current supported upgrade guidance rather than assuming that remaining on an affected branch is sufficient.
What about FortiSwitchManager and FortiSASE?
Current Fortinet CNA data now provides a more complete remediation matrix for these products.
- FortiSwitchManager 7.0: upgrade to 7.0.6 or above.
- FortiSwitchManager 7.2: upgrade to 7.2.7 or above.
- FortiSASE 25.1: Fortinet states the issue was remediated in 25.1.b.
- FortiSASE 25.2: Fortinet states the issue was remediated in 25.2.c.
This means administrators should no longer rely on a FortiOS-only version list when checking CVE-2025-25249. Match the deployed product and branch against the current Fortinet advisory or vendor CVE record before selecting a remediation path.
What administrators should do now
Inventory internet-facing and internally deployed Fortinet systems that could fall within the CVE-2025-25249 product scope. Record the product, software branch and build before changing anything.
For FortiOS, verify the installed branch against Fortinet’s release notes and supported upgrade path. For FortiSwitchManager, current vendor data lists 7.0.6 and 7.2.7 as the fixed branch thresholds. FortiSASE remediation is listed for 25.1.b and 25.2.c.
Treat affected deployments as urgent because the vulnerability is associated with known exploitation. Follow Fortinet’s current upgrade guidance, change-control process and availability requirements rather than applying an unsupported version blindly.
Do not erase logs, configuration state or other incident evidence before determining whether the system may have been exposed or exploited.
A successful upgrade proves that the installed software state changed. It does not establish that exploitation never occurred before remediation. Review current Fortinet, CISA and organisational incident-response guidance for compromise indicators and investigation steps.
Recheck Fortinet and CISA if they publish new forensic indicators, affected-version corrections, mitigation changes or exploitation details.
Does being in CISA KEV mean your device was hacked?
No. Known Exploited Vulnerabilities status means there is evidence that the vulnerability has been exploited in the wild; it does not prove that every vulnerable appliance or service was compromised. Whether a particular environment was exploited requires evidence from that environment.
Patch status and compromise status should therefore be treated as two separate questions. The first asks whether the vulnerable software has been remediated. The second asks whether there is evidence that an attacker used the flaw before remediation.
Does patching alone close the incident?
Not necessarily. If an affected system was exposed while exploitation was possible, applying the CVE-2025-25249 remediation removes the known vulnerable software state but does not automatically establish that credentials, configuration, persistence mechanisms or connected systems were untouched beforehand.
For an organisation with meaningful exposure, document the pre-remediation state, complete the vendor-supported fix, preserve and review available logs and indicators, and escalate through the organisation’s incident-response process when compromise cannot be ruled out.
What does the September 12 CISA remediation date mean?
Current KEV-derived records associate a September 12, 2026 remediation due date with CVE-2025-25249. CISA Binding Operational Directive requirements directly govern covered U.S. federal civilian executive branch agencies. Private companies and organisations outside that scope should not interpret that federal date as a universal legal deadline.
For organisations outside the directive’s scope, KEV inclusion remains a strong security-prioritisation signal because it indicates known exploitation, but legal and operational obligations depend on the organisation’s jurisdiction, contracts, policies and regulatory environment.
What is known about PivotC2 exploitation?
SOCRadar has reported exploitation of CVE-2025-25249 involving PivotC2. The reviewed primary and vendor evidence does not establish that every exploitation campaign used PivotC2.
PivotC2 should therefore be treated as a reported campaign detail, not as a universal indicator of CVE-2025-25249 exploitation. Absence of a PivotC2 indicator does not prove that an affected system was not targeted through the vulnerability.
Confirmed, reported and unresolved
Confirmed from Fortinet documentation: CVE-2025-25249 is fixed in the reviewed FortiOS releases 7.0.18, 7.2.12, 7.4.9 and 7.6.4.
Confirmed from current Fortinet CNA data: FortiSwitchManager remediation is listed as 7.0.6 or above and 7.2.7 or above; FortiSASE remediation is listed for 25.1.b and 25.2.c.
Current KEV state: current CISA-derived records identify CVE-2025-25249 as known exploited and added on September 9, 2026. Direct retrieval of the controlling CISA catalog entry remained unavailable during this review.
Reported: SOCRadar reports exploitation involving PivotC2.
Still unresolved: authoritative victim count and geography, complete campaign attribution, and a final controlling set of compromise indicators applicable to every affected product and environment.
Verification note
ThePulseSignal reviewed current CISA-derived KEV evidence, Fortinet FortiOS release documentation, current Fortinet CNA vulnerability data and attributed threat reporting about exploitation of CVE-2025-25249. FortiOS fixed-release claims are supported by primary vendor release notes. FortiSwitchManager and FortiSASE remediation states are supported by the current Fortinet CNA record. Campaign-specific details remain explicitly attributed rather than being presented as universal facts.