Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

A heap-based buffer overflow vulnerability has been identified in multiple Fortinet products including FortiOS, FortiSwitchManager, and FortiSASE. The vulnerability allows remote attackers to execute unauthorized code or commands by sending specially crafted packets. It has been assigned CVE-2025-25249 and is tracked under Fortinet's PSIRT advisory FG-IR-25-084. CISA has flagged this vulnerability under BOD 26-04, indicating it requires prioritized remediation. The high criticality rating suggests active exploitation risk or significant potential impact on affected organizations. Forensic triage requirements have been outlined by CISA as part of the BOD 26-04 implementation guidance. Organizations using affected Fortinet products should apply patches immediately and review their network infrastructure for signs of compromise.