HIGHVulnerability
Verified
Global

CISA KEV: Fortinet Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

Analysis

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-09. Remediation due: 2026-09-12.

Indicators of Compromise (1)

CVE (1)
CVE-2025-25249
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 9, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

Fortra Patches Critical Vulnerabilities in BoKS

The bugs could lead to authentication bypass, shell command execution, and memory corruption. The post Fortra Patches Critical Vulnerabilities in BoKS appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations

Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This report examines how core areas of

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-92084 — The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W...

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcode

CVE-2026-92084
NIST NVD