Hackers Are Exploiting a Fortinet Flaw to Plant Remote-Control Malware on Network Devices

Key points

• CVE-2025-25249, a high-severity bug in Fortinet's FortiOS and FortiSwitchManager products, was patched in January 2026 but remains unpatched on thousands of devices.
• Hackers scanned more than 30,000 IP addresses and successfully infected 178 devices with a remote-control tool called PivotC2.
• At least two intrusions led to data being stolen, with attacks focused mainly on US organisations.
• CISA, the US government's cybersecurity agency, added the flaw to its must-patch list on Wednesday and gave federal agencies three days to act.
• Fixed versions exist across four FortiOS releases and two FortiSwitchManager releases; organisations running older versions should update immediately.

What happened?

Criminals have been breaking into Fortinet network devices by exploiting a flaw that lets anyone on the internet run commands on an affected machine without a password. Once inside, they install PivotC2, a remote-access tool (software that gives attackers full keyboard control of a machine from anywhere in the world) built specifically to burrow deep into a network.

The flaw, tracked as CVE-2025-25249, is a heap-based buffer overflow: a programming mistake that lets an attacker send a specially crafted request and hijack the device. Fortinet scored it 7.4 out of 10 and published a fix in its own advisory in January. Many organisations haven't applied it.

Threat intelligence firm SOCRadar, first to report the active exploitation, says the hackers targeted more than 30,000 IP addresses, infected 178 devices, and in at least two cases walked off with data. The attacks focus mainly on US targets and have been running since at least July 2026. SOCRadar believes the campaign is run by a Russian-speaking criminal group and that PivotC2 was likely built with AI assistance. Network appliance flaws like this one follow a pattern we've tracked repeatedly this autumn: WatchGuard's five critical remote-takeover bugs patched on 1 September are a recent parallel.

What does PivotC2 actually do?

Once installed, PivotC2 gives attackers an interactive shell (a text-based control panel, essentially a remote keyboard into the device), lets them tunnel traffic through the infected machine to hide their movements, scan the internal network for further targets, and scrape configuration files that may contain passwords and network maps. A device infected with PivotC2 becomes a quiet foothold, useful for escalating an attack far beyond the original entry point.

What versions are affected, and what should organisations do?

Fortinet shipped fixes across six software releases. Check your version against this table:

CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalogue on Wednesday, triggering a binding directive that gives US federal agencies three days to patch. Private organisations aren't legally bound by that deadline, but live exploitation since July makes waiting a poor choice.

Push the update now, then check device logs for unexpected outbound connections or new administrator accounts. If a device may already be compromised, bring in an incident-response team before wiping and rebuilding: you need to understand whether attackers moved further into your network first.