Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Patch FortiGate firewalls: an exploited FortiOS flaw, and no fix for 6.4

CISA added a FortiOS heap overflow to its exploited list on September 9. Here are the fixed versions, a workaround if you can't upgrade yet, and why FortiOS 6.4 needs to go.

If you manage FortiGate firewalls, check your FortiOS version. A heap-based buffer overflow in FortiOS’s cw_acd daemon can let a remote, unauthenticated attacker run code or commands on the firewall. CISA added it to its Known Exploited Vulnerabilities catalog on September 9, 2026.

The details

  • CVE: CVE-2025-25249 (Fortinet advisory FG-IR-25-084), CVSS 7.4
  • Affected: FortiOS and FortiSwitchManager. CISA’s entry also lists FortiSASE, Fortinet’s cloud service.
  • Exploitation: Fortinet’s advisory, first published in January, still lists it as not known to be exploited. CISA’s addition in September means exploitation has since been seen.

Fixed versions

Product Affected Fix
FortiOS 7.6 7.6.0 through 7.6.3 7.6.4 or later
FortiOS 7.4 7.4.0 through 7.4.8 7.4.9 or later
FortiOS 7.2 7.2.0 through 7.2.11 7.2.12 or later
FortiOS 7.0 7.0.0 through 7.0.17 7.0.18 or later
FortiOS 6.4 All versions No fix. Migrate to a fixed release.
FortiSwitchManager 7.2 7.2.0 through 7.2.6 7.2.7 or later
FortiSwitchManager 7.0 7.0.0 through 7.0.5 7.0.6 or later

Use Fortinet’s upgrade path tool (linked below) to plan the jump between versions.

Still on FortiOS 6.4? There’s no patch for this, and there won’t be. Plan the move to a supported release now, and use the workaround below in the meantime.

Workaround if you can’t upgrade yet

The vulnerable daemon is reached through the “fabric” management access on an interface. Fortinet’s workarounds:

  • Remove “fabric” from each interface’s allowed access. For example, change set allowaccess fabric ssh https to set allowaccess ssh https.
  • Or restrict CAPWAP control traffic (UDP ports 5246 to 5249) on interfaces where fabric is enabled, using a local-in policy that allows only your trusted devices. Fortinet’s advisory includes the full configuration.

A workaround reduces exposure; it doesn’t replace the upgrade.

Sources

All articles