Protego field desk
PROTEGO
← CVE Lookup

CVE-2025-25249

CRITICALCVSS 3.1 · 9.8 · NIST NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

CISA KEV: known exploited

Added: 2026-09-09 · Due: 2026-09-12

Known ransomware use: Unknown

EPSS: 3.74% · Percentile: 89.8%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-122, CWE-787 · Published: 2026-01-13T17:15:56.910 · Modified: 2026-10-07T18:17:13.180

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 3.1: 9.8 (CRITICAL) · NIST NVD
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSS 3.1: 8.1 (HIGH) · psirt@fortinet.com
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References and fixes