FortiGate Is Being Turned Into a RAT. PivotC2 Is Exploiting an Old RCE

• The Mess: Attackers are actively exploiting CVE-2025-25249 in FortiGate to deploy PivotC2, a custom Node.js remote-access Trojan built specifically for compromised Fortinet appliances.
• The Damage: The firewall can become the attacker’s foothold, proxy, credential store and tunnel into the internal network.
• The Fix: Patch FortiOS immediately, restrict CAPWAP exposure, rotate credentials and hunt compromised FortiGate devices.

The Bug Was Already Patched

CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon used by FortiOS and FortiSwitchManager.

The flaw allows a remote unauthenticated attacker to execute arbitrary commands through specially crafted traffic. Fortinet released fixes in January 2026.

So why is this news now?

Because attackers are finally turning the bug into a serious post-exploitation platform.

Meet PivotC2

SOCRadar researchers say they observed exploitation dating back to at least July 2026.

The attackers use the FortiGate vulnerability to obtain execution and then deploy PivotC2, a Node.js RAT designed specifically for FortiGate appliances.

PivotC2 isn’t a generic Linux backdoor.

It knows what it is running on.

The framework provides:

• interactive shell access
• file upload and download
• SOCKS5 and HTTP tunneling
• local and remote port forwarding
• network scanning
• FortiGate configuration harvesting
• credential extraction
• automated post-exploitation

That last part is particularly ugly.

The firewall becomes an operational attack platform rather than just a compromised device.

The Firewall Becomes the Pivot

PivotC2 establishes outbound encrypted communication with its command-and-control infrastructure.

That matters because defenders often focus on incoming connections to the firewall.

The malware can instead turn the compromised appliance into the thing making connections outward.

From there, attackers can use the FortiGate as a bridge into networks that were never directly exposed to the Internet.

SOCRadar reported more than 30,000 targeted IP addresses and identified 178 devices that it says were infected with PivotC2. Those figures come from SOCRadar’s telemetry and have not been independently published by Fortinet as a victim count.

The CAPWAP Problem

CVE-2025-25249 lives in the cw_acd daemon associated with CAPWAP.

The affected service uses UDP 5246 for CAPWAP Control traffic.

That creates an uncomfortable question for FortiGate administrators:

Can the vulnerable service be reached from an untrusted network?

If yes, the firewall may have been sitting directly on the attack surface.

Fortinet’s fixes cover multiple FortiOS branches, including releases such as 7.0.18, 7.2.12, 7.4.9 and 7.6.4.

Patch First. Then Assume Nothing.

Updating the firewall is only step one.

If an affected FortiGate was exposed while vulnerable, administrators should also investigate:

• unexpected outbound connections
• unexplained administrator activity
• modified firewall configuration
• unknown VPN credentials
• suspicious tunnels
• unexpected processes
• unusual traffic from the appliance
• newly created or modified accounts

Credentials stored on or accessible from a compromised firewall should be considered potentially exposed.

That includes VPN credentials.

It also includes credentials used to access internal infrastructure.

AI May Have Helped Build the RAT

SOCRadar says the recovered PivotC2 code contains comments and usage guidance suggesting that the attackers likely used AI assistance during development.

That doesn’t mean AI independently created the malware.

It means the campaign is another example of attackers using AI-assisted development to build specialized tooling faster.

And PivotC2 is specialized.

It understands the target platform, automates reconnaissance and can operate as a network pivot.

Bugstoday Opinion

This is what makes old vulnerabilities dangerous.

CVE-2025-25249 was patched months ago.

The vulnerability didn’t suddenly become worse.

The attackers got better at using it.

A firewall running vulnerable firmware is already a problem. A firewall running vulnerable firmware that has been converted into an encrypted RAT and network tunnel is something else entirely.

Patch the appliance.

Then hunt it like a compromised Linux server.

Because that’s what it may have become.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

SOCRadar Threat Research Unit — CVE-2025-25249 / PivotC2
Fortinet PSIRT — FG-IR-25-084
NCSC Netherlands — NCSC-2026-0015
CVE.org — CVE-2025-25249