{"vulnerability": "cve-2025-25249", "sightings": [{"uuid": "fdf66551-1d72-4ac4-9330-52e434e10068", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mcd34sceo22g", "content": "", "creation_timestamp": "2026-01-13T17:25:04.108441Z"}, {"uuid": "b67006f2-09af-4de0-bd94-dca85b8e8751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcd3qaek542y", "content": "", "creation_timestamp": "2026-01-13T17:35:54.462141Z"}, {"uuid": "168acee9-fab6-47bc-b293-5930493f8554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mce6txmaok2q", "content": "", "creation_timestamp": "2026-01-14T04:04:20.660285Z"}, {"uuid": "d3f37399-6961-4b43-99c9-e206ccec9766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-25249", "type": "seen", "source": "https://gist.github.com/Darkcrai86/45f4c256c8074121c8876b78492ca689", "content": "", "creation_timestamp": "2026-01-14T08:27:19.000000Z"}, {"uuid": "ece9b6cc-9264-4625-95f7-34c334484b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mciws5svuj2e", "content": "", "creation_timestamp": "2026-01-16T01:23:29.817794Z"}, {"uuid": "7827af80-9a2e-47ff-a34f-fc4576426c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcokosuzis2k", "content": "", "creation_timestamp": "2026-01-18T07:02:52.238110Z"}, {"uuid": "46f7864c-0ebc-426d-94f4-58905801787e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcolervvvc2k", "content": "", "creation_timestamp": "2026-01-18T07:15:10.499183Z"}, {"uuid": "eee82393-3855-418a-817b-4500451eae99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3muyv4iz2nk2q", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT", "creation_timestamp": "2026-09-08T11:09:33.498334Z"}, {"uuid": "8c9d4e16-866b-4b5f-b47f-7ca4ba1d4b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3muzctk7zya2o", "content": "FortiGate Post-Exploitation RAT, PivotC2\u00a0Spotted by\u00a0SOCRadar\n\nThe SOCRadar Threat Research Unit (STRU) identified, with high confidence, exploitation of CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager cw_acd daemon....", "creation_timestamp": "2026-09-08T15:15:05.898963Z"}, {"uuid": "d7ffcb3f-d6d8-48e0-927f-4f8d7d452bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3muzj6j3onp2t", "content": "FortiGate firewalls hit by CVE-2025-25249 exploit deploying PivotC2 malware at scale. #Security #FortiGate #NodeJS #PivotC2 #CyberAttack #Vulnerability thedailytechfeed.com/major-fortig...", "creation_timestamp": "2026-09-08T17:08:36.275133Z"}, {"uuid": "c35bb098-4c0e-4fa7-b53b-8d5495233ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-25249", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117236565143530281", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT#CVE_2025_25249 #PivotC2 https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/", "creation_timestamp": "2026-09-08T17:20:18.364292Z"}, {"uuid": "fd598703-4d95-452b-bb62-d2990a5d6758", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muzonm45ls2t", "content": "CVE-2025-25249 is trending. Hype score 18, currently #1 on cvemon.\n\nA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2025-25249", "creation_timestamp": "2026-09-08T18:46:30.776318Z"}, {"uuid": "6d02165a-c389-4be6-8756-f208d9030ec1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://t.me/hacking_Attack/193561", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT\nhttps://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/\n\n  submitted by    /u/socradario  (https://www.reddit.com/user/socradario) \n [link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)", "creation_timestamp": "2026-09-08T20:00:04.289163Z"}, {"uuid": "e2474f46-672c-4b93-92ea-0ffd0ef6320a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "MISP/616cfae2-9da9-48bb-8be3-053d5b26bf13", "content": "", "creation_timestamp": "2026-09-10T12:15:02.476487Z"}, {"uuid": "21542173-a906-4ce5-8ee2-bd6d7ddfe8f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/193561", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT\nhttps://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/\n\n  submitted by    /u/socradario  (https://www.reddit.com/user/socradario) \n [link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)", "creation_timestamp": "2026-09-09T00:00:25.880673Z"}, {"uuid": "1d54da21-3f50-4a18-89c9-187e31f47d1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mv2ybmykxe2x", "content": "FortiGate qurilmalari nishonda: CVE-2025-25249 orqali PivotC2 zararli dasturi tarqatilmoqda!\n\n", "creation_timestamp": "2026-09-09T07:11:26.302368Z"}, {"uuid": "210b823a-ba17-4a7c-955d-a45eae97cf88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mv3lcu6r2k2j", "content": "\ud83d\udea8 New research from the SOCRadar Threat Research Unit!\n\nCVE-2025-25249 is being actively exploited to deploy PivotC2, a FortiGate-focused Node.js RAT.\n\n30K+ targets. 178 confirmed infections. AI-assisted development, tunneling & autonomous post-exploitation.\n\nRead more \ud83d\udc47\nsocradar.io/blog/cve-202...", "creation_timestamp": "2026-09-09T12:52:11.141285Z"}, {"uuid": "6946cbd4-bb92-4739-a13c-761cc7d07af0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64f2d211-92cd-4826-92a9-c4f61659b1fb", "content": "", "creation_timestamp": "2026-09-09T16:00:29.476863Z"}, {"uuid": "8f2c9f6d-9eb8-4a2a-b9c0-cb17a0012995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv4ci5kpcz2z", "content": "\ud83d\uded1 CVE-2025-25249\nFortinet Multiple Products\nCVSS 8.1 / EPSS 1% / KEV \u2705\nTL;DR: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3\u2026\nhttps://cvesentinel.com/report/CVE-2025-25249?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-09T19:46:42.167525Z"}, {"uuid": "ed495074-3cbe-4ad7-b57d-b92a36751184", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/76235c89-e484-4042-96ad-26f9515fbf7e", "content": "", "creation_timestamp": "2026-09-09T20:00:03.901162Z"}, {"uuid": "9fccd02a-5a74-4b84-a734-7cf94401d22d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mv4dlq7rg52g", "content": "~Cisa~\nCISA added four actively exploited Fortinet, Citrix, Chromium, and Cisco vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2025-25249, CVE-2026-19490, CVE-2026-87491\n-\n#CVE #Cybersecurity #ThreatIntel", "creation_timestamp": "2026-09-09T20:06:36.584623Z"}, {"uuid": "52c0703d-8a65-4d9b-9f91-f7169d51337b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mv4hhopzom2k", "content": "\ud83d\udce1 CVE-2025-25249: A Patched FortiGate Flaw Is Now Delivering a Custom RAT Called PivotC2", "creation_timestamp": "2026-09-09T21:15:55.142974Z"}, {"uuid": "8303a3ad-bc82-4882-8965-5879ded174d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mv4lxuum2m2l", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2025-25249", "creation_timestamp": "2026-09-09T22:36:33.786647Z"}, {"uuid": "a2ba173a-21ac-4556-be65-9bb0dd768f65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://t.me/ViralCyber/26157", "content": "\ud83d\udfe2\u0648\u0642\u062a\u06cc \u06a9\u0647 Fortigate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u0634\u0648\u062f!\n\ud83d\udd34\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 FortiGate\n\ud83d\udd34\u06af\u0632\u0627\u0631\u0634 \u062c\u062f\u06cc\u062f SOCRadar \u0627\u0632 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-25249 \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0645\u062d\u0628\u0648\u0628 Fortinet \u062e\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0627\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f.\n\ud83d\udd34\u062f\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 FortiGate \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f\u06cc \u0628\u0647 \u0646\u0627\u0645 PivotC2 \u0631\u0627 \u0631\u0648\u06cc \u0622\u0646 \u0646\u0635\u0628 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0631\u0648\u06cc Firewall \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0631\u062f\u0647 \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0627\u06cc\u062c\u0627\u062f Reverse Shell\u060c \u062a\u0648\u0646\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc\u060c Port Scanning\u060c \u0633\u0631\u0642\u062a Configuration \u0648 Credentials \u0648 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc (Lateral Movement) \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f!\n\ud83d\udd34\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634 SOCRadar\u060c \u0628\u06cc\u0634 \u0627\u0632 \u06f3\u06f0 \u0647\u0632\u0627\u0631 IP \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0648 \u062d\u062f\u0627\u0642\u0644 \u06f1\u06f7\u06f8 \u062f\u0633\u062a\u06af\u0627\u0647 FortiGate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 PivotC2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0646\u06cc\u0632 \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u062c\u0648\u0644\u0627\u06cc \u06f2\u06f0\u06f2\u06f6 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0648 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u062f\u0627\u0645\u0647 \u062f\u0627\u0631\u062f.\n\ud83d\udd34 \u0646\u06a9\u062a\u0647 \u0639\u062c\u06cc\u0628 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u062e\u0648\u062f Firewall \u06a9\u0647 \u0639\u0644\u06cc \u0627\u0644\u0627\u0635\u0648\u0644 \u0628\u0627\u06cc\u062f \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 \u062f\u0641\u0627\u0639\u06cc \u0628\u0627\u0634\u062f \u0628\u0647 \u0646\u0642\u0637\u0647 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0648 Pivot \u0645\u0647\u0627\u062c\u0645 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f!  \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0635\u0631\u0641\u0627\u064b Patch \u06a9\u0631\u062f\u0646 \u062a\u062c\u0647\u06cc\u0632 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0628\u0644\u06cc \u0627\u0632 \u0646\u0633\u062e\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u060c \u0628\u0631\u0631\u0633\u06cc \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0646\u06cc\u0632 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a.\n\u2705 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u062f\u06cc\u0631\u0627\u0646 \u0634\u0628\u06a9\u0647:\n\u26ab\ufe0f\u0646\u0633\u062e\u0647 FortiOS \u0648 FortiSwitchManager \u0631\u0627 \u0641\u0648\u0631\u0627\u064b \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f.\n\u26ab\ufe0f \u062f\u0633\u062a\u0631\u0633\u06cc CAPWAP / UDP 5246 \u0627\u0632 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0637\u0645\u0626\u0646 \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u0644\u0627\u06af\u0647\u0627\u060c Configuration\u060c \u062d\u0633\u0627\u0628\u200c\u0647\u0627 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u062e\u0631\u0648\u062c\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc Firewall \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u062f\u0631 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9\u060c \u0627\u062d\u062a\u0645\u0627\u0644 \u0633\u0631\u0642\u062a Credential \u0648 \u0646\u0641\u0648\u0630 \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n#FortiGate #Fortinet #CyberSecurity #CVE #Firewall #PivotC2\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-09-09T23:00:04.572058Z"}, {"uuid": "90c04f83-b9e6-40be-a136-9e83a918bc56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "exploited", "source": "https://t.me/ViralCyber/26157", "content": "\ud83d\udfe2\u0648\u0642\u062a\u06cc \u06a9\u0647 Fortigate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u0634\u0648\u062f!\n\ud83d\udd34\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 FortiGate\n\ud83d\udd34\u06af\u0632\u0627\u0631\u0634 \u062c\u062f\u06cc\u062f SOCRadar \u0627\u0632 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-25249 \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0645\u062d\u0628\u0648\u0628 Fortinet \u062e\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0627\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f.\n\ud83d\udd34\u062f\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 FortiGate \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f\u06cc \u0628\u0647 \u0646\u0627\u0645 PivotC2 \u0631\u0627 \u0631\u0648\u06cc \u0622\u0646 \u0646\u0635\u0628 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0631\u0648\u06cc Firewall \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0631\u062f\u0647 \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0627\u06cc\u062c\u0627\u062f Reverse Shell\u060c \u062a\u0648\u0646\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc\u060c Port Scanning\u060c \u0633\u0631\u0642\u062a Configuration \u0648 Credentials \u0648 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc (Lateral Movement) \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f!\n\ud83d\udd34\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634 SOCRadar\u060c \u0628\u06cc\u0634 \u0627\u0632 \u06f3\u06f0 \u0647\u0632\u0627\u0631 IP \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0648 \u062d\u062f\u0627\u0642\u0644 \u06f1\u06f7\u06f8 \u062f\u0633\u062a\u06af\u0627\u0647 FortiGate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 PivotC2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0646\u06cc\u0632 \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u062c\u0648\u0644\u0627\u06cc \u06f2\u06f0\u06f2\u06f6 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0648 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u062f\u0627\u0645\u0647 \u062f\u0627\u0631\u062f.\n\ud83d\udd34 \u0646\u06a9\u062a\u0647 \u0639\u062c\u06cc\u0628 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u062e\u0648\u062f Firewall \u06a9\u0647 \u0639\u0644\u06cc \u0627\u0644\u0627\u0635\u0648\u0644 \u0628\u0627\u06cc\u062f \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 \u062f\u0641\u0627\u0639\u06cc \u0628\u0627\u0634\u062f \u0628\u0647 \u0646\u0642\u0637\u0647 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0648 Pivot \u0645\u0647\u0627\u062c\u0645 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f!  \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0635\u0631\u0641\u0627\u064b Patch \u06a9\u0631\u062f\u0646 \u062a\u062c\u0647\u06cc\u0632 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0628\u0644\u06cc \u0627\u0632 \u0646\u0633\u062e\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u060c \u0628\u0631\u0631\u0633\u06cc \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0646\u06cc\u0632 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a.\n\u2705 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u062f\u06cc\u0631\u0627\u0646 \u0634\u0628\u06a9\u0647:\n\u26ab\ufe0f\u0646\u0633\u062e\u0647 FortiOS \u0648 FortiSwitchManager \u0631\u0627 \u0641\u0648\u0631\u0627\u064b \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f.\n\u26ab\ufe0f \u062f\u0633\u062a\u0631\u0633\u06cc CAPWAP / UDP 5246 \u0627\u0632 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0637\u0645\u0626\u0646 \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u0644\u0627\u06af\u0647\u0627\u060c Configuration\u060c \u062d\u0633\u0627\u0628\u200c\u0647\u0627 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u062e\u0631\u0648\u062c\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc Firewall \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u062f\u0631 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9\u060c \u0627\u062d\u062a\u0645\u0627\u0644 \u0633\u0631\u0642\u062a Credential \u0648 \u0646\u0641\u0648\u0630 \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n#FortiGate #Fortinet #CyberSecurity #CVE #Firewall #PivotC2\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-09-10T00:00:09.001792Z"}, {"uuid": "2b1ff1c0-f03a-41ea-90dc-d36d2c5f4dea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-023", "content": "", "creation_timestamp": "2026-09-10T00:15:03.634376Z"}, {"uuid": "869cd1ed-bc4a-4dca-a5d6-7b24aaddc566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mv4w4ep6jy22", "content": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Hea...\n\n\ud83d\udd17 https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-10T01:38:43.980658Z"}, {"uuid": "9ea845bc-59d1-468e-91ed-92d30264b0ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv5ghp55dx2e", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2025-25249: \u26a0\ufe0f CVE-2025-25249: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.8%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2025-25249-a-heap-based-buffer-overflow-vulnerability-in", "creation_timestamp": "2026-09-10T06:30:41.897508Z"}, {"uuid": "e713ce9f-454c-4edd-ace8-c10c3dc6ed2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mv5h5wzbmi23", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "creation_timestamp": "2026-09-10T06:43:08.756883Z"}, {"uuid": "a8e56699-3a1d-4c4a-9108-1155ced16156", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mv5h5zb7p22g", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "creation_timestamp": "2026-09-10T06:43:14.333987Z"}, {"uuid": "f286a6da-b7a4-49e9-893f-7db1dbcc9bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mv5h6lqcya25", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "creation_timestamp": "2026-09-10T06:43:30.545317Z"}, {"uuid": "24f1a5a5-e669-42a7-b779-fb5e84527e05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/", "content": "The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\n\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.", "creation_timestamp": "2026-09-10T07:00:38.564700Z"}, {"uuid": "47b24f9f-5ef7-4861-aa49-208e5ee0f365", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://t.me/information_security_channel/55882", "content": "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\nhttps://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/\n\nThe high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks (https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-10T11:00:03.462609Z"}, {"uuid": "2fd51f9b-77ef-4121-9213-69b90648c324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqwbd6i2k", "content": "Fortinet flaw CVE-2025-25249 is fueling PivotC2 RAT attacks despite being patched months ago. Clearly nobody felt like applying it.\n\n#PatchYourFlaws #JustAnotherDay", "creation_timestamp": "2026-09-10T11:22:11.025828Z"}, {"uuid": "ac02b782-02fa-4ecc-b7db-c1937c2f0863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqylcql2w", "content": "Just another Tuesday in IT, as unpatched Fortinet appliances deliver PivotC2 remote access trojans right into victim networks. This high-severity, unauthenticated CVE-2025-25249 flaw was patched way back in January 2026, yet here we are watching attacks happen anyway. Protecting ...\n\nRead full story", "creation_timestamp": "2026-09-10T11:22:13.268386Z"}, {"uuid": "355f7a36-5555-40b1-ba99-7ecaaf03dbc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://t.me/pphm_HackerNews/3088", "content": "\ud83d\udd34 Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\n\nThreat actors have been exploiting an unauthenticated remote code execution (RCE) vulnerability in Fortinet products to deploy a Node.js RAT, SOCRadar reports.\n\nTracked as CVE-2025-25249 (CVSS score of 7.4) and described as a heap-based buffer overflow issue, the high-severity bug was patched in January in FortiOS and FortiSwitchManager.\n\nThe flaw \u201cmay allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,\u201d Fortinet noted in its advisory.", "creation_timestamp": "2026-09-10T14:00:04.528284Z"}, {"uuid": "5d9e58b2-75cc-43df-97dd-c87586fc6b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mv77e7pfru2s", "content": "CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in\u00a0Attacks\n\nThe U.S. Cybersecurity and Infrastructure Security Agency has added a critical Fortinet vulnerability, tracked as CVE-2025-25249, to its Known Exploited Vulnerabilities catalog after confirming evidence of active\u2026", "creation_timestamp": "2026-09-10T23:28:48.811423Z"}, {"uuid": "0e314286-4907-4872-af5b-07ff75eb685a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3088", "content": "\ud83d\udd34 Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\n\nThreat actors have been exploiting an unauthenticated remote code execution (RCE) vulnerability in Fortinet products to deploy a Node.js RAT, SOCRadar reports.\n\nTracked as CVE-2025-25249 (CVSS score of 7.4) and described as a heap-based buffer overflow issue, the high-severity bug was patched in January in FortiOS and FortiSwitchManager.\n\nThe flaw \u201cmay allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,\u201d Fortinet noted in its advisory.", "creation_timestamp": "2026-09-11T00:00:36.194204Z"}, {"uuid": "dacdc565-b56c-483c-8693-883c878ba800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://t.me/information_security_channel/55882", "content": "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\nhttps://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/\n\nThe high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks (https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-11T00:00:41.214408Z"}, {"uuid": "225d3f7c-d516-4f0b-a681-0aff95a08fac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/", "content": "The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\n\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.", "creation_timestamp": "2026-09-11T01:00:34.803717Z"}, {"uuid": "73518126-d2e3-4dee-91d6-201d0590d36c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvaorgcxme2v", "content": "\ud83d\udea8 CRITICAL THREAT BRIEF: CVE-2025-25249 (Fortinet FortiOS & Gateway Infrastructure)\n\nActive exploitation verified by the CISA KEV matrix has placed enterprise network perimeters at risk due to a critical heap-based buffer overflow vulnerability.\n\n\ud83d\udd17 Read the full intelligence brief:\u2026", "creation_timestamp": "2026-09-11T13:37:17.674823Z"}, {"uuid": "44c784c2-0bec-4736-b31d-61a91df64773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvdd4saj4f25", "content": "\ud83d\udd34 EXPLOITED\n\nCVE-2025-25249: Fortinet FortiOS and FortiSwitchManager contain a heap-based buffer overflow that allows an attacker to execute unauthorized code via specially crafted packets. The flaw is listed in CISA KEV. Fortinet has released fixed versions; update affected installations.", "creation_timestamp": "2026-09-12T14:46:53.323605Z"}, {"uuid": "45eb12f1-c96f-4017-9eb9-caf5aba38a89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhabw3evq2i", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:06:42.434602Z"}, {"uuid": "516be116-b8e3-41e1-88fa-afb5bfba2fa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvhabwj2xn2k", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email BO CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #PotatoSecurity", "creation_timestamp": "2026-09-14T04:06:43.063498Z"}, {"uuid": "0a544dfc-8dc5-48bd-9082-9d79750f7df8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhacnfvtx2e", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:07:06.934517Z"}, {"uuid": "042ccdd1-2aae-46cb-89c3-2e00881caeef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhaflnz2v2l", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "creation_timestamp": "2026-09-14T04:08:46.183375Z"}, {"uuid": "184ba2eb-ece2-4c4b-8acc-99861962be89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhahybpxq2j", "content": "3/ FIREWALLS + PATCH: FortiGate CVE-2025-25249 exploited (PivotC2 RAT, 178 devices). PAN-OS CVE-2026-0310 (CVSS 9.2) root RCE. Sept Patch Tuesday: 973 vulns, 2 zero-days. Audit SSO, rotate creds, patch edge. #ThreatIntel", "creation_timestamp": "2026-09-14T04:10:06.219908Z"}, {"uuid": "bdbfed18-a36d-4166-aec8-f0720f21c4ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvhdqymn7s2i", "content": "\ud83d\udd34 Fortinet CVE-2025-25249 under active attack\n\nAttackers are exploiting the Fortinet flaw to deploy PivotC2. Researchers found 30,000+ targeted IPs and 178 confirmed infected devices.\n\nstemshop.top/blog/fortine...\n\n#CVE #CVE202525249 #Fortinet #FortiGate #PivotC2 #CyberSecurity", "creation_timestamp": "2026-09-14T05:08:54.184367Z"}, {"uuid": "ffba34ec-9aa4-4665-9787-31a86bd1d012", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvhku7vx4q2n", "content": "Discover how the PivotC2 FortiGate RAT uses CVE-2025-25249 exploitation to harvest credentials and tunnel traffic across corporate network environments.\n\n#PivotC2 #FortiGate #Malware #Cybercrime #CVE202525249", "creation_timestamp": "2026-09-14T07:15:54.903611Z"}, {"uuid": "e667954a-7f10-44a3-acf5-e88f507624a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mvhobw6fpswn", "content": "Fortinet\u88fd\u54c1\u306b\u304a\u3051\u308b\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001RAT\u300cPivotC2\u300d\u304c\u5c55\u958b\u3055\u308c\u308b\uff08CVE-2025-25249\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47685/", "creation_timestamp": "2026-09-14T08:17:14.755726Z"}, {"uuid": "2e1d20f8-60ed-475b-a454-9a7f17a0b512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://bsky.app/profile/bigg-thecreator.bsky.social/post/3mvl7cwswto27", "content": "CVE-2025-25249 is scored 7.4 by Fortinet's advisory and 9.8 by NVD. Same bug, two records, opposite sides of a severity boundary.\n\nIt is also the one SOCRadar tied to a campaign that infected 178 devices.\n\nIf two authorities disagree on the number, the number is not your sort key.", "creation_timestamp": "2026-09-15T18:00:04.150248Z"}, {"uuid": "d0fad6f8-c8b0-439b-81f8-65aee934c8eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-25249", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-rce-vulnerability-fortinet-fortios-and-fortiswitchmanager-patch-immediately", "content": "", "creation_timestamp": "2026-09-16T12:45:02.126140Z"}]}