[UPDATE] [hoch] Fortinet FortiOS: Schwachstelle ermöglicht Codeausführung
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiOS ausnutzen, um beliebigen Programmcode auszuführen.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0085
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2025-25249Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 53% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-25249 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedFortinet security advisory (AV26-023) - Update 1cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerabilitycisa-kev
Recent advisories for Fortinet FortiOS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- medium[NEU] [mittel] Fortinet FortiProxy und FortiOS: Mehrere Schwachstellencert-bund · 2026-09-09
- highCVE-2026-84393: A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.…nvd · 2026-09-08
- lowCVE-2026-84392: A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all v…nvd · 2026-09-08
- medium[NEW] [medium] Fortinet FortiOS: Multiple vulnerabilities enable code execution and DoScert-bund · 2026-08-13
- mediumCVE-2026-71408: A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0…nvd · 2026-08-12
- mediumCVE-2026-71407: A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 …nvd · 2026-08-12
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [mittel] OpenSSH: Mehrere Schwachstellen2026-09-10
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen2026-09-10
- high[UPDATE] [hoch] OpenVPN: Mehrere Schwachstellen2026-09-10
- medium[UPDATE] [mittel] gzip: Mehrere Schwachstellen2026-09-10
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen2026-09-10