VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 10:46 UTC

CVE-2025-25249

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 al…

Read full description

CVSS 7.4 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.1/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.4: +1.11
Fresh EPSS: 3.74%: +0.02

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Resecurity

Press · 11 Sep 2026, 07:00 · CISA KEV Alert: Cisco, Citrix, and Fortinet Vulnerabilities Under Active Exploitation - Resecurity

SecurityWeek

Press · 10 Sep 2026, 07:00 · Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks - SecurityWeek

The Hacker News

Press · 10 Sep 2026, 07:00 · CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline - The Hacker News

Security Affairs

Press · 10 Sep 2026, 07:00 · U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vuln... - Security Affairs

Press · 09 Sep 2026, 07:00 · Hackers Exploit FortiGate Vulnerability To Deploy Custom Node.js Remote-Access Malware - LinkedIn

See all 11 source documents

SOCRadar

Press · 08 Sep 2026, 07:00 · CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT - SOCRadar

CyberSecurityNews

Press · 08 Sep 2026, 07:00 · Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware - CyberSecurityNews

heise online

Press · 14 Jan 2026, 08:00 · Fortinet closes security vulnerabilities in FortiOS, FortiSIEM, and more - heise online

SecurityWeek

Press · 14 Jan 2026, 08:00 · Fortinet Patches Critical Vulnerabilities in FortiFone, FortiSIEM - SecurityWeek

Cyber Press

Press · 14 Jan 2026, 08:00 · FortiOS and FortiSwitchManager Vulnerabilities Allow Remote Code Execution - Cyber Press

Arctic Wolf

Press · 13 Jan 2026, 08:00 · CVE-2025-25249: Remote Code Execution Vulnerability in FortiOS and FortiSwitchManager - Arctic Wolf

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.1 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.4; EPSS 3.7%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:31.695937+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

13 Jan 2026, 08:00

Published

13 Jan 2026, 16:32

Added to the CISA KEV catalog

09 Sep 2026, 00:00

Latest press mention

11 Sep 2026, 07:00

Score calculated

05 Nov 2026, 13:59