CVE-2025-25249
Fortinet Multiple Products
Summary
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
Published 2026-09-09 · first seen here 2026-10-10
CISA required action (due 2026-09-12): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Analysis & write-ups
No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.
Where it shows in your logs
CISA requires forensic triage for this CVE (BOD 26-04): check affected systems for signs of compromise, don't just patch.
Edge or network appliance (firewall, VPN, gateway) · Memory corruption (overflow, use-after-free) high confidence
Appliances usually run no EDR, so device logs, firewall flow logs and the vendor's integrity checker are often the only evidence. Get the logs off the box: attackers often wipe local logs.
What to look for
- Appliance crashes, core dumps or unexpected reboots, often from repeated attempts
- Session or config changes right after a crash
- Configuration changes, new local admin accounts or new VPN users on the appliance
- Admin or VPN logins from unfamiliar IPs, especially VPS or hosting providers
- New outbound connections from the appliance's own IP (it should rarely start connections)
- Gaps in the appliance's logs, unexpected reboots or crashes, or logs that were cleared
Data sources
Appliance system and admin logs · ATT&CK DS0015 Application Log Content
- Sentinel
CommonSecurityLog (CEF from Fortinet, Palo Alto, Check Point, Cisco)Syslog- Splunk
Vendor add-ons: fortigate_event, pan:system, pan:config, cisco:asa, citrix:netscaler:syslog, f5:bigip:syslogChange.All_Changes- CrowdStrike
Falcon Next-Gen SIEM: third-party firewall / VPN connectors
Authentication and sessions · ATT&CK DS0028 Logon Session Creation / DS0002 User Account Authentication
- Sentinel
SigninLogsSecurityEvent (4624, 4625, 4648)DeviceLogonEventsIdentityLogonEvents_Im_Authentication- Splunk
Authentication.Authenticationpan:globalprotectVPN sourcetypes- CrowdStrike
UserLogonUserLogonFailed2Falcon Identity Protection events
Network connections · ATT&CK DS0029 Network Connection Creation / Network Traffic Flow
- Sentinel
DeviceNetworkEventsCommonSecurityLog (firewall)_Im_NetworkSession- Splunk
Network_Traffic.All_TrafficFirewall sourcetypes (pan:traffic, fortigate_traffic, cisco:asa)- CrowdStrike
NetworkConnectIP4NetworkReceiveAcceptIP4NetworkConnectIP6
Process creation · ATT&CK DS0009 Process Creation
- Sentinel
DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate- Splunk
Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)- CrowdStrike
ProcessRollup2SyntheticProcessRollup2
A generic baseline worked out from the product type and weakness (CWE-122, CWE-787), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.