7.4 Élevée Exploitée

CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Campagnes de rançongiciel Non constatée à ce jour

Faiblesse CWE-787, CWE-122

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Produits et versions touchés

Produit	Versions touchées	Corrigé en
FortiSwitchManager 7.2	7.2.2 → 7.2.5	Pas de correctif indiqué
FortiSASE	25.1.a.2	Pas de correctif indiqué
FortiOS 7.6	7.6.0 → 7.6.2	Pas de correctif indiqué
FortiOS 7.4	7.4.0 → 7.4.7	Pas de correctif indiqué
FortiOS 7.2	7.2.4 → 7.2.11	Pas de correctif indiqué
RUGGEDCOM APE1808	Versions non publiées

Références

fortiguard.fortinet.com fortiguard.fortinet.com

Chronologie

Publiée 13 janvier 2026
Ajoutée au catalogue KEV 9 septembre 2026
Dernière modification 15 octobre 2026

Les 20 CVE de FortiSwitchManager →

CVE-2026-59840 A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all… 4.1 Moyenne CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability 5.4 Moyenne CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability 9.1 Critique CVE-2024-26008 An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3… 5.0 Moyenne

Suivre cette CVE