{"metadata": {"vulnerability": "CVE-2025-25249", "count": 122, "kinds": {"milestone": 10, "sighting": 54, "kev": 11, "other": 47}}, "data": [{"timestamp": "2025-02-05T13:31:18.866Z", "date_only": false, "value": "2025-02-05T13:31:18.866Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-25249", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-13T00:00:00Z", "date_only": false, "value": "2025-05-13T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-13T00:00:00Z", "date_only": false, "value": "2025-05-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-13T00:00:00Z", "date_only": false, "value": "2025-05-13T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-13T00:00:00Z", "date_only": false, "value": "2025-05-13T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-07-08T00:00:00Z", "date_only": false, "value": "2025-07-08T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-07-08T00:00:00Z", "date_only": false, "value": "2025-07-08T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0015", "record": "NCSC-2026-0015", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2025-09-09T00:00:00Z", "date_only": false, "value": "2025-09-09T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2025-09-09T00:00:00Z", "date_only": false, "value": "2025-09-09T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2025-11-11T00:00:00Z", "date_only": false, "value": "2025-11-11T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2025-11-11T00:00:00Z", "date_only": false, "value": "2025-11-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-01-13T00:00:00Z", "date_only": false, "value": "2026-01-13T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-01-13T00:00:00Z", "date_only": false, "value": "2026-01-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-01-13T00:00:00Z", "date_only": true, "value": "2026-01-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0035", "record": "CERTFR-2026-AVI-0035", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-01-13T16:32:35.662Z", "date_only": false, "value": "2026-01-13T16:32:35.662Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-25249", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-01-13T17:15:56Z", "date_only": false, "value": "2026-01-13T17:15:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MJ8X-M8F5-X4W8", "record": "GHSA-MJ8X-M8F5-X4W8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-01-13T17:15:56.910Z", "date_only": false, "value": "2026-01-13T17:15:56.910", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25249", "record": "FKIE_CVE-2025-25249", "field": "published"}, {"timestamp": "2026-01-13T17:25:04.108Z", "date_only": false, "value": "2026-01-13T17:25:04.108441Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mcd34sceo22g", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "fdf66551-1d72-4ac4-9330-52e434e10068", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mcd34sceo22g"}, {"timestamp": "2026-01-13T17:35:54.462Z", "date_only": false, "value": "2026-01-13T17:35:54.462141Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcd3qaek542y", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "b67006f2-09af-4de0-bd94-dca85b8e8751", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mcd3qaek542y"}, {"timestamp": "2026-01-13T18:31:07Z", "date_only": false, "value": "2026-01-13T18:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MJ8X-M8F5-X4W8", "record": "GHSA-MJ8X-M8F5-X4W8", "field": "published"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0085", "record": "WID-SEC-W-2026-0085", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0085", "record": "WID-SEC-W-2026-0085", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0085", "record": "WID-SEC-W-2026-0085", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0085", "record": "WID-SEC-W-2026-0085", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0035", "record": "CERTFR-2026-AVI-0035", "field": "last_revision_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0035", "record": "CERTFR-2026-AVI-0035", "field": "initial_release_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0035", "record": "CERTFR-2026-AVI-0035", "field": "revisions.0.revision_date"}, {"timestamp": "2026-01-14T04:04:20.660Z", "date_only": false, "value": "2026-01-14T04:04:20.660285Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mce6txmaok2q", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "168acee9-fab6-47bc-b293-5930493f8554", "url": "https://bsky.app/profile/opsmatters.com/post/3mce6txmaok2q"}, {"timestamp": "2026-01-14T07:15:57.366Z", "date_only": false, "value": "2026-01-14T07:15:57.366+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0085", "record": "WID-SEC-W-2026-0085", "field": "document.tracking.generator.date"}, {"timestamp": "2026-01-14T08:27:19Z", "date_only": false, "value": "2026-01-14T08:27:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Darkcrai86/45f4c256c8074121c8876b78492ca689", "record": "cve-2025-25249", "field": "creation_timestamp", "uuid": "d3f37399-6961-4b43-99c9-e206ccec9766", "url": "https://gist.github.com/Darkcrai86/45f4c256c8074121c8876b78492ca689"}, {"timestamp": "2026-01-15T12:31:57.265Z", "date_only": false, "value": "2026-01-15T12:31:57.265723Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0015", "record": "NCSC-2026-0015", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-15T12:31:57.265Z", "date_only": false, "value": "2026-01-15T12:31:57.265723Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0015", "record": "NCSC-2026-0015", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-01-16T01:23:29.817Z", "date_only": false, "value": "2026-01-16T01:23:29.817794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mciws5svuj2e", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "ece9b6cc-9264-4625-95f7-34c334484b21", "url": "https://bsky.app/profile/opsmatters.com/post/3mciws5svuj2e"}, {"timestamp": "2026-01-18T07:02:52.238Z", "date_only": false, "value": "2026-01-18T07:02:52.238110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcokosuzis2k", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "7827af80-9a2e-47ff-a34f-fc4576426c80", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcokosuzis2k"}, {"timestamp": "2026-01-18T07:15:10.499Z", "date_only": false, "value": "2026-01-18T07:15:10.499183Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcolervvvc2k", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "46f7864c-0ebc-426d-94f4-58905801787e", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcolervvvc2k"}, {"timestamp": "2026-01-22T00:00:00Z", "date_only": false, "value": "2026-01-22T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2026-01-22T00:00:00Z", "date_only": false, "value": "2026-01-22T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2026-01-22T14:36:08.752Z", "date_only": false, "value": "2026-01-22T14:36:08.752265Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2026-02-10T00:00:00Z", "date_only": false, "value": "2026-02-10T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2026-02-10T00:00:00Z", "date_only": false, "value": "2026-02-10T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2026-02-12T07:00:00Z", "date_only": false, "value": "2026-02-12T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2026-02-23T08:51:58.404Z", "date_only": false, "value": "2026-02-23T08:51:58.404Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / fortinet", "record": "CVE-2025-25249", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-09T00:00:00Z", "date_only": false, "value": "2026-06-09T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2026-06-09T00:00:00Z", "date_only": false, "value": "2026-06-09T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2026-07-08T18:39:23.153Z", "date_only": false, "value": "2026-07-08T18:39:23.153528Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-09T06:00:00Z", "date_only": false, "value": "2026-07-09T06:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2026-07-09T06:00:00Z", "date_only": false, "value": "2026-07-09T06:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-25-135-01", "record": "ICSA-25-135-01", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-14T00:00:00Z", "date_only": false, "value": "2026-07-14T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2026-09-08T11:09:33.498Z", "date_only": false, "value": "2026-09-08T11:09:33.498334Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3muyv4iz2nk2q", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "eee82393-3855-418a-817b-4500451eae99", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3muyv4iz2nk2q"}, {"timestamp": "2026-09-08T15:03:00Z", "date_only": false, "value": "2026-09-08T15:03:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2025-25249", "field": "timestamps.asserted_at", "uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T15:03:00Z", "date_only": false, "value": "2026-09-08T15:03:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2025-25249", "field": "evidence.0.details.added_date", "uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T15:03:00Z", "date_only": false, "value": "2026-09-08T15:03:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2025-25249", "field": "timestamps.first_seen_at", "uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T15:03:00Z", "date_only": false, "value": "2026-09-08T15:03:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2025-25249", "field": "status.status_updated_at", "uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T15:15:05.898Z", "date_only": false, "value": "2026-09-08T15:15:05.898963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3muzctk7zya2o", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "8c9d4e16-866b-4b5f-b47f-7ca4ba1d4b3a", "content": "FortiGate Post-Exploitation RAT, PivotC2\u00a0Spotted by\u00a0SOCRadar\n\nThe SOCRadar Threat Research Unit (STRU) identified, with high confidence, exploitation of CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager cw_acd daemon....", "url": "https://bsky.app/profile/theitnerd.ca/post/3muzctk7zya2o"}, {"timestamp": "2026-09-08T17:08:36.275Z", "date_only": false, "value": "2026-09-08T17:08:36.275133Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3muzj6j3onp2t", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "d7ffcb3f-d6d8-48e0-927f-4f8d7d452bfd", "content": "FortiGate firewalls hit by CVE-2025-25249 exploit deploying PivotC2 malware at scale. #Security #FortiGate #NodeJS #PivotC2 #CyberAttack #Vulnerability thedailytechfeed.com/major-fortig...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3muzj6j3onp2t"}, {"timestamp": "2026-09-08T17:20:18.364Z", "date_only": false, "value": "2026-09-08T17:20:18.364292Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117236565143530281", "record": "cve-2025-25249", "field": "creation_timestamp", "uuid": "c35bb098-4c0e-4fa7-b53b-8d5495233ad4", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT#CVE_2025_25249 #PivotC2 https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/", "url": "https://infosec.exchange/users/threatcodex/statuses/117236565143530281"}, {"timestamp": "2026-09-08T18:46:30.776Z", "date_only": false, "value": "2026-09-08T18:46:30.776318Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muzonm45ls2t", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "fd598703-4d95-452b-bb62-d2990a5d6758", "content": "CVE-2025-25249 is trending. Hype score 18, currently #1 on cvemon.\n\nA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2025-25249", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3muzonm45ls2t"}, {"timestamp": "2026-09-08T20:00:04.289Z", "date_only": false, "value": "2026-09-08T20:00:04.289163Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/193561", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "6d02165a-c389-4be6-8756-f208d9030ec1", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT\nhttps://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/\n\n  submitted by    /u/socradario  (https://www.reddit.com/user/socradario) \n [link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)", "url": "https://t.me/hacking_Attack/193561"}, {"timestamp": "2026-09-09T00:00:00Z", "date_only": false, "value": "2026-09-09T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "timestamps.asserted_at", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T00:00:00Z", "date_only": true, "value": "2026-09-09", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-25249", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-09T00:00:00Z", "date_only": true, "value": "2026-09-09", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "evidence.0.details.date_added", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T00:00:00Z", "date_only": false, "value": "2026-09-09T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "timestamps.first_seen_at", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T00:00:00Z", "date_only": false, "value": "2026-09-09T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "status.status_updated_at", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T00:00:25.880Z", "date_only": false, "value": "2026-09-09T00:00:25.880673Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/193561", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "21542173-a906-4ce5-8ee2-bd6d7ddfe8f9", "content": "CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT\nhttps://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/\n\n  submitted by    /u/socradario  (https://www.reddit.com/user/socradario) \n [link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)", "url": "https://t.me/hacking_Attack/193561"}, {"timestamp": "2026-09-09T07:11:26.302Z", "date_only": false, "value": "2026-09-09T07:11:26.302368Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mv2ybmykxe2x", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "1d54da21-3f50-4a18-89c9-187e31f47d1d", "content": "FortiGate qurilmalari nishonda: CVE-2025-25249 orqali PivotC2 zararli dasturi tarqatilmoqda!\n\n", "url": "https://bsky.app/profile/arc-codex.com/post/3mv2ybmykxe2x"}, {"timestamp": "2026-09-09T12:52:11.141Z", "date_only": false, "value": "2026-09-09T12:52:11.141285Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hack4career.com/post/3mv3lcu6r2k2j", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "210b823a-ba17-4a7c-955d-a45eae97cf88", "content": "\ud83d\udea8 New research from the SOCRadar Threat Research Unit!\n\nCVE-2025-25249 is being actively exploited to deploy PivotC2, a FortiGate-focused Node.js RAT.\n\n30K+ targets. 178 confirmed infections. AI-assisted development, tunneling & autonomous post-exploitation.\n\nRead more \ud83d\udc47\nsocradar.io/blog/cve-202...", "url": "https://bsky.app/profile/hack4career.com/post/3mv3lcu6r2k2j"}, {"timestamp": "2026-09-09T16:00:01Z", "date_only": false, "value": "2026-09-09T16:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2025-25249", "field": "timestamps.recorded_at", "uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T16:00:29.476Z", "date_only": false, "value": "2026-09-09T16:00:29.476863Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64f2d211-92cd-4826-92a9-c4f61659b1fb", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "6946cbd4-bb92-4739-a13c-761cc7d07af0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64f2d211-92cd-4826-92a9-c4f61659b1fb"}, {"timestamp": "2026-09-09T19:46:42.167Z", "date_only": false, "value": "2026-09-09T19:46:42.167525Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv4ci5kpcz2z", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "8f2c9f6d-9eb8-4a2a-b9c0-cb17a0012995", "content": "\ud83d\uded1 CVE-2025-25249\nFortinet Multiple Products\nCVSS 8.1 / EPSS 1% / KEV \u2705\nTL;DR: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3\u2026\nhttps://cvesentinel.com/report/CVE-2025-25249?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv4ci5kpcz2z"}, {"timestamp": "2026-09-09T20:00:01Z", "date_only": false, "value": "2026-09-09T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "timestamps.recorded_at", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-09T20:00:03.901Z", "date_only": false, "value": "2026-09-09T20:00:03.901162Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/76235c89-e484-4042-96ad-26f9515fbf7e", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "ed495074-3cbe-4ad7-b57d-b92a36751184", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/76235c89-e484-4042-96ad-26f9515fbf7e"}, {"timestamp": "2026-09-09T20:06:36.584Z", "date_only": false, "value": "2026-09-09T20:06:36.584623Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mv4dlq7rg52g", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "9fccd02a-5a74-4b84-a734-7cf94401d22d", "content": "~Cisa~\nCISA added four actively exploited Fortinet, Citrix, Chromium, and Cisco vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2025-25249, CVE-2026-19490, CVE-2026-87491\n-\n#CVE #Cybersecurity #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mv4dlq7rg52g"}, {"timestamp": "2026-09-09T21:15:55.142Z", "date_only": false, "value": "2026-09-09T21:15:55.142974Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mv4hhopzom2k", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "52c0703d-8a65-4d9b-9f91-f7169d51337b", "content": "\ud83d\udce1 CVE-2025-25249: A Patched FortiGate Flaw Is Now Delivering a Custom RAT Called PivotC2", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3mv4hhopzom2k"}, {"timestamp": "2026-09-09T21:30:26Z", "date_only": false, "value": "2026-09-09T21:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MJ8X-M8F5-X4W8", "record": "GHSA-MJ8X-M8F5-X4W8", "field": "modified"}, {"timestamp": "2026-09-09T22:36:33.786Z", "date_only": false, "value": "2026-09-09T22:36:33.786647Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mv4lxuum2m2l", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "8303a3ad-bc82-4882-8965-5879ded174d5", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2025-25249", "url": "https://bsky.app/profile/csirts.com/post/3mv4lxuum2m2l"}, {"timestamp": "2026-09-09T23:00:04.572Z", "date_only": false, "value": "2026-09-09T23:00:04.572058Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ViralCyber/26157", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "a2ba173a-21ac-4556-be65-9bb0dd768f65", "content": "\ud83d\udfe2\u0648\u0642\u062a\u06cc \u06a9\u0647 Fortigate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u0634\u0648\u062f!\n\ud83d\udd34\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 FortiGate\n\ud83d\udd34\u06af\u0632\u0627\u0631\u0634 \u062c\u062f\u06cc\u062f SOCRadar \u0627\u0632 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-25249 \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0645\u062d\u0628\u0648\u0628 Fortinet \u062e\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0627\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f.\n\ud83d\udd34\u062f\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 FortiGate \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f\u06cc \u0628\u0647 \u0646\u0627\u0645 PivotC2 \u0631\u0627 \u0631\u0648\u06cc \u0622\u0646 \u0646\u0635\u0628 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0631\u0648\u06cc Firewall \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0631\u062f\u0647 \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0627\u06cc\u062c\u0627\u062f Reverse Shell\u060c \u062a\u0648\u0646\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc\u060c Port Scanning\u060c \u0633\u0631\u0642\u062a Configuration \u0648 Credentials \u0648 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc (Lateral Movement) \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f!\n\ud83d\udd34\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634 SOCRadar\u060c \u0628\u06cc\u0634 \u0627\u0632 \u06f3\u06f0 \u0647\u0632\u0627\u0631 IP \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0648 \u062d\u062f\u0627\u0642\u0644 \u06f1\u06f7\u06f8 \u062f\u0633\u062a\u06af\u0627\u0647 FortiGate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 PivotC2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0646\u06cc\u0632 \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u062c\u0648\u0644\u0627\u06cc \u06f2\u06f0\u06f2\u06f6 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0648 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u062f\u0627\u0645\u0647 \u062f\u0627\u0631\u062f.\n\ud83d\udd34 \u0646\u06a9\u062a\u0647 \u0639\u062c\u06cc\u0628 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u062e\u0648\u062f Firewall \u06a9\u0647 \u0639\u0644\u06cc \u0627\u0644\u0627\u0635\u0648\u0644 \u0628\u0627\u06cc\u062f \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 \u062f\u0641\u0627\u0639\u06cc \u0628\u0627\u0634\u062f \u0628\u0647 \u0646\u0642\u0637\u0647 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0648 Pivot \u0645\u0647\u0627\u062c\u0645 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f!  \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0635\u0631\u0641\u0627\u064b Patch \u06a9\u0631\u062f\u0646 \u062a\u062c\u0647\u06cc\u0632 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0628\u0644\u06cc \u0627\u0632 \u0646\u0633\u062e\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u060c \u0628\u0631\u0631\u0633\u06cc \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0646\u06cc\u0632 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a.\n\u2705 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u062f\u06cc\u0631\u0627\u0646 \u0634\u0628\u06a9\u0647:\n\u26ab\ufe0f\u0646\u0633\u062e\u0647 FortiOS \u0648 FortiSwitchManager \u0631\u0627 \u0641\u0648\u0631\u0627\u064b \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f.\n\u26ab\ufe0f \u062f\u0633\u062a\u0631\u0633\u06cc CAPWAP / UDP 5246 \u0627\u0632 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0637\u0645\u0626\u0646 \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u0644\u0627\u06af\u0647\u0627\u060c Configuration\u060c \u062d\u0633\u0627\u0628\u200c\u0647\u0627 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u062e\u0631\u0648\u062c\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc Firewall \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u062f\u0631 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9\u060c \u0627\u062d\u062a\u0645\u0627\u0644 \u0633\u0631\u0642\u062a Credential \u0648 \u0646\u0641\u0648\u0630 \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n#FortiGate #Fortinet #CyberSecurity #CVE #Firewall #PivotC2\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "url": "https://t.me/ViralCyber/26157"}, {"timestamp": "2026-09-10T00:00:09.001Z", "date_only": false, "value": "2026-09-10T00:00:09.001792Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ViralCyber/26157", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "90c04f83-b9e6-40be-a136-9e83a918bc56", "content": "\ud83d\udfe2\u0648\u0642\u062a\u06cc \u06a9\u0647 Fortigate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u0634\u0648\u062f!\n\ud83d\udd34\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 FortiGate\n\ud83d\udd34\u06af\u0632\u0627\u0631\u0634 \u062c\u062f\u06cc\u062f SOCRadar \u0627\u0632 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-25249 \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0645\u062d\u0628\u0648\u0628 Fortinet \u062e\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0627\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f.\n\ud83d\udd34\u062f\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 FortiGate \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f\u06cc \u0628\u0647 \u0646\u0627\u0645 PivotC2 \u0631\u0627 \u0631\u0648\u06cc \u0622\u0646 \u0646\u0635\u0628 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0631\u0648\u06cc Firewall \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0631\u062f\u0647 \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0627\u06cc\u062c\u0627\u062f Reverse Shell\u060c \u062a\u0648\u0646\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc\u060c Port Scanning\u060c \u0633\u0631\u0642\u062a Configuration \u0648 Credentials \u0648 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc (Lateral Movement) \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f!\n\ud83d\udd34\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634 SOCRadar\u060c \u0628\u06cc\u0634 \u0627\u0632 \u06f3\u06f0 \u0647\u0632\u0627\u0631 IP \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0648 \u062d\u062f\u0627\u0642\u0644 \u06f1\u06f7\u06f8 \u062f\u0633\u062a\u06af\u0627\u0647 FortiGate \u0622\u0644\u0648\u062f\u0647 \u0628\u0647 PivotC2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0646\u06cc\u0632 \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u062c\u0648\u0644\u0627\u06cc \u06f2\u06f0\u06f2\u06f6 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0648 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u062f\u0627\u0645\u0647 \u062f\u0627\u0631\u062f.\n\ud83d\udd34 \u0646\u06a9\u062a\u0647 \u0639\u062c\u06cc\u0628 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u062e\u0648\u062f Firewall \u06a9\u0647 \u0639\u0644\u06cc \u0627\u0644\u0627\u0635\u0648\u0644 \u0628\u0627\u06cc\u062f \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 \u062f\u0641\u0627\u0639\u06cc \u0628\u0627\u0634\u062f \u0628\u0647 \u0646\u0642\u0637\u0647 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0648 Pivot \u0645\u0647\u0627\u062c\u0645 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f!  \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0635\u0631\u0641\u0627\u064b Patch \u06a9\u0631\u062f\u0646 \u062a\u062c\u0647\u06cc\u0632 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0628\u0644\u06cc \u0627\u0632 \u0646\u0633\u062e\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u060c \u0628\u0631\u0631\u0633\u06cc \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0646\u06cc\u0632 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a.\n\u2705 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u062f\u06cc\u0631\u0627\u0646 \u0634\u0628\u06a9\u0647:\n\u26ab\ufe0f\u0646\u0633\u062e\u0647 FortiOS \u0648 FortiSwitchManager \u0631\u0627 \u0641\u0648\u0631\u0627\u064b \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f.\n\u26ab\ufe0f \u062f\u0633\u062a\u0631\u0633\u06cc CAPWAP / UDP 5246 \u0627\u0632 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0637\u0645\u0626\u0646 \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u0644\u0627\u06af\u0647\u0627\u060c Configuration\u060c \u062d\u0633\u0627\u0628\u200c\u0647\u0627 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u062e\u0631\u0648\u062c\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc Firewall \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n\u26ab\ufe0f \u062f\u0631 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9\u060c \u0627\u062d\u062a\u0645\u0627\u0644 \u0633\u0631\u0642\u062a Credential \u0648 \u0646\u0641\u0648\u0630 \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n#FortiGate #Fortinet #CyberSecurity #CVE #Firewall #PivotC2\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "url": "https://t.me/ViralCyber/26157"}, {"timestamp": "2026-09-10T00:15:03.634Z", "date_only": false, "value": "2026-09-10T00:15:03.634376Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-023", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "2b1ff1c0-f03a-41ea-90dc-d36d2c5f4dea", "url": "https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-023"}, {"timestamp": "2026-09-10T01:38:43.980Z", "date_only": false, "value": "2026-09-10T01:38:43.980658Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mv4w4ep6jy22", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "869cd1ed-bc4a-4dca-a5d6-7b24aaddc566", "content": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Hea...\n\n\ud83d\udd17 https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog", "url": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mv4w4ep6jy22"}, {"timestamp": "2026-09-10T03:55:15.906Z", "date_only": false, "value": "2026-09-10T03:55:15.906990Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-25249", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-10T03:55:15.906Z", "date_only": false, "value": "2026-09-10T03:55:15.906990Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25249", "record": "FKIE_CVE-2025-25249", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-10T06:30:41.897Z", "date_only": false, "value": "2026-09-10T06:30:41.897508Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv5ghp55dx2e", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "9ea845bc-59d1-468e-91ed-92d30264b0ab", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2025-25249: \u26a0\ufe0f CVE-2025-25249: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.8%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2025-25249-a-heap-based-buffer-overflow-vulnerability-in", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv5ghp55dx2e"}, {"timestamp": "2026-09-10T06:43:08.756Z", "date_only": false, "value": "2026-09-10T06:43:08.756883Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mv5h5wzbmi23", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "e713ce9f-454c-4edd-ace8-c10c3dc6ed2a", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mv5h5wzbmi23"}, {"timestamp": "2026-09-10T06:43:14.333Z", "date_only": false, "value": "2026-09-10T06:43:14.333987Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mv5h5zb7p22g", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "a8e56699-3a1d-4c4a-9108-1155ced16156", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mv5h5zb7p22g"}, {"timestamp": "2026-09-10T06:43:30.545Z", "date_only": false, "value": "2026-09-10T06:43:30.545317Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mv5h6lqcya25", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "f286a6da-b7a4-49e9-893f-7db1dbcc9bb1", "content": "Threat actors exploit CVE-2025-25249 in Fortinet devices to deploy PivotC2 RAT, enabling post-exploitation capabilities and data theft, prompting urgent patching.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mv5h6lqcya25"}, {"timestamp": "2026-09-10T07:00:38.564Z", "date_only": false, "value": "2026-09-10T07:00:38.564700Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "24f1a5a5-e669-42a7-b779-fb5e84527e05", "content": "The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\n\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.", "url": "https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/"}, {"timestamp": "2026-09-10T11:00:03.462Z", "date_only": false, "value": "2026-09-10T11:00:03.462609Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/55882", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "47b24f9f-5ef7-4861-aa49-208e5ee0f365", "content": "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\nhttps://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/\n\nThe high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.\nThe post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks (https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55882"}, {"timestamp": "2026-09-10T11:22:11.025Z", "date_only": false, "value": "2026-09-10T11:22:11.025828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqwbd6i2k", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "2fd51f9b-77ef-4121-9213-69b90648c324", "content": "Fortinet flaw CVE-2025-25249 is fueling PivotC2 RAT attacks despite being patched months ago. Clearly nobody felt like applying it.\n\n#PatchYourFlaws #JustAnotherDay", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqwbd6i2k"}, {"timestamp": "2026-09-10T11:22:13.268Z", "date_only": false, "value": "2026-09-10T11:22:13.268386Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqylcql2w", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "ac02b782-02fa-4ecc-b7db-c1937c2f0863", "content": "Just another Tuesday in IT, as unpatched Fortinet appliances deliver PivotC2 remote access trojans right into victim networks. This high-severity, unauthenticated CVE-2025-25249 flaw was patched way back in January 2026, yet here we are watching attacks happen anyway. Protecting ...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mv5wqylcql2w"}, {"timestamp": "2026-09-10T12:15:02.476Z", "date_only": false, "value": "2026-09-10T12:15:02.476487Z", "kind": "sighting", "label": "Seen", "source": "MISP/616cfae2-9da9-48bb-8be3-053d5b26bf13", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "e2474f46-672c-4b93-92ea-0ffd0ef6320a"}, {"timestamp": "2026-09-10T14:00:04.528Z", "date_only": false, "value": "2026-09-10T14:00:04.528284Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3088", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "355f7a36-5555-40b1-ba99-7ecaaf03dbc5", "content": "\ud83d\udd34 Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\n\nThreat actors have been exploiting an unauthenticated remote code execution (RCE) vulnerability in Fortinet products to deploy a Node.js RAT, SOCRadar reports.\n\nTracked as CVE-2025-25249 (CVSS score of 7.4) and described as a heap-based buffer overflow issue, the high-severity bug was patched in January in FortiOS and FortiSwitchManager.\n\nThe flaw \u201cmay allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,\u201d Fortinet noted in its advisory.", "url": "https://t.me/pphm_HackerNews/3088"}, {"timestamp": "2026-09-10T14:21:16.974Z", "date_only": false, "value": "2026-09-10T14:21:16.974644Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0015", "record": "NCSC-2026-0015", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-10T14:21:16.974Z", "date_only": false, "value": "2026-09-10T14:21:16.974644Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0015", "record": "NCSC-2026-0015", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-10T23:28:48.811Z", "date_only": false, "value": "2026-09-10T23:28:48.811423Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mv77e7pfru2s", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "5d9e58b2-75cc-43df-97dd-c87586fc6b45", "content": "CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in\u00a0Attacks\n\nThe U.S. Cybersecurity and Infrastructure Security Agency has added a critical Fortinet vulnerability, tracked as CVE-2025-25249, to its Known Exploited Vulnerabilities catalog after confirming evidence of active\u2026", "url": "https://bsky.app/profile/newsarea.bsky.social/post/3mv77e7pfru2s"}, {"timestamp": "2026-09-11T00:00:36.194Z", "date_only": false, "value": "2026-09-11T00:00:36.194204Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3088", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "0e314286-4907-4872-af5b-07ff75eb685a", "content": "\ud83d\udd34 Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks\n\nThreat actors have been exploiting an unauthenticated remote code execution (RCE) vulnerability in Fortinet products to deploy a Node.js RAT, SOCRadar reports.\n\nTracked as CVE-2025-25249 (CVSS score of 7.4) and described as a heap-based buffer overflow issue, the high-severity bug was patched in January in FortiOS and FortiSwitchManager.\n\nThe flaw \u201cmay allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,\u201d Fortinet noted in its advisory.", "url": "https://t.me/pphm_HackerNews/3088"}, {"timestamp": "2026-09-11T13:37:17.674Z", "date_only": false, "value": "2026-09-11T13:37:17.674823Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvaorgcxme2v", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "73518126-d2e3-4dee-91d6-201d0590d36c", "content": "\ud83d\udea8 CRITICAL THREAT BRIEF: CVE-2025-25249 (Fortinet FortiOS & Gateway Infrastructure)\n\nActive exploitation verified by the CISA KEV matrix has placed enterprise network perimeters at risk due to a critical heap-based buffer overflow vulnerability.\n\n\ud83d\udd17 Read the full intelligence brief:\u2026", "url": "https://bsky.app/profile/thecybermind.co/post/3mvaorgcxme2v"}, {"timestamp": "2026-09-12T00:00:00Z", "date_only": true, "value": "2026-09-12", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-25249", "field": "evidence.0.details.due_date", "uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-12T14:46:53.323Z", "date_only": false, "value": "2026-09-12T14:46:53.323605Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mvdd4saj4f25", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "44c784c2-0bec-4736-b31d-61a91df64773", "content": "\ud83d\udd34 EXPLOITED\n\nCVE-2025-25249: Fortinet FortiOS and FortiSwitchManager contain a heap-based buffer overflow that allows an attacker to execute unauthorized code via specially crafted packets. The flaw is listed in CISA KEV. Fortinet has released fixed versions; update affected installations.", "url": "https://bsky.app/profile/suriq.io/post/3mvdd4saj4f25"}, {"timestamp": "2026-09-14T04:06:42.434Z", "date_only": false, "value": "2026-09-14T04:06:42.434602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhabw3evq2i", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "45eb12f1-c96f-4017-9eb9-caf5aba38a89", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhabw3evq2i"}, {"timestamp": "2026-09-14T04:06:43.063Z", "date_only": false, "value": "2026-09-14T04:06:43.063498Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mvhabwj2xn2k", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "516be116-b8e3-41e1-88fa-afb5bfba2fa5", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email BO CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #PotatoSecurity", "url": "https://bsky.app/profile/potato.software/post/3mvhabwj2xn2k"}, {"timestamp": "2026-09-14T04:07:06.934Z", "date_only": false, "value": "2026-09-14T04:07:06.934517Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhacnfvtx2e", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "0a544dfc-8dc5-48bd-9082-9d79750f7df8", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhacnfvtx2e"}, {"timestamp": "2026-09-14T04:08:46.183Z", "date_only": false, "value": "2026-09-14T04:08:46.183375Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhaflnz2v2l", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "042ccdd1-2aae-46cb-89c3-2e00881caeef", "content": "\ud83d\udea8 BREAKING: Dropbox breached via Lenovo SSO \u2014 5,000 accounts accessed w/o passwords. Microsoft 1M-email AI CEO fraud + passkey phishing. UNC3569 exploiting Tencent Sogou Input (CVE-2026-51990) \u2192 GrayRabbit. FortiGate CVE-2025-25249 (PivotC2 RAT). PAN-OS CVE-2026-0310 (CVSS 9.2). #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhaflnz2v2l"}, {"timestamp": "2026-09-14T04:10:06.219Z", "date_only": false, "value": "2026-09-14T04:10:06.219908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhahybpxq2j", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "184ba2eb-ece2-4c4b-8acc-99861962be89", "content": "3/ FIREWALLS + PATCH: FortiGate CVE-2025-25249 exploited (PivotC2 RAT, 178 devices). PAN-OS CVE-2026-0310 (CVSS 9.2) root RCE. Sept Patch Tuesday: 973 vulns, 2 zero-days. Audit SSO, rotate creds, patch edge. #ThreatIntel", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvhahybpxq2j"}, {"timestamp": "2026-09-14T05:08:54.184Z", "date_only": false, "value": "2026-09-14T05:08:54.184367Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvhdqymn7s2i", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "bdbfed18-a36d-4166-aec8-f0720f21c4ba", "content": "\ud83d\udd34 Fortinet CVE-2025-25249 under active attack\n\nAttackers are exploiting the Fortinet flaw to deploy PivotC2. Researchers found 30,000+ targeted IPs and 178 confirmed infected devices.\n\nstemshop.top/blog/fortine...\n\n#CVE #CVE202525249 #Fortinet #FortiGate #PivotC2 #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvhdqymn7s2i"}, {"timestamp": "2026-09-14T07:15:54.903Z", "date_only": false, "value": "2026-09-14T07:15:54.903611Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvhku7vx4q2n", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "ffba34ec-9aa4-4665-9787-31a86bd1d012", "content": "Discover how the PivotC2 FortiGate RAT uses CVE-2025-25249 exploitation to harvest credentials and tunnel traffic across corporate network environments.\n\n#PivotC2 #FortiGate #Malware #Cybercrime #CVE202525249", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mvhku7vx4q2n"}, {"timestamp": "2026-09-14T08:17:14.755Z", "date_only": false, "value": "2026-09-14T08:17:14.755726Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mvhobw6fpswn", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "e667954a-7f10-44a3-acf5-e88f507624a0", "content": "Fortinet\u88fd\u54c1\u306b\u304a\u3051\u308b\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001RAT\u300cPivotC2\u300d\u304c\u5c55\u958b\u3055\u308c\u308b\uff08CVE-2025-25249\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47685/", "url": "https://bsky.app/profile/shiojiri.com/post/3mvhobw6fpswn"}, {"timestamp": "2026-09-15T18:00:04.150Z", "date_only": false, "value": "2026-09-15T18:00:04.150248Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bigg-thecreator.bsky.social/post/3mvl7cwswto27", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "2e1d20f8-60ed-475b-a454-9a7f17a0b512", "content": "CVE-2025-25249 is scored 7.4 by Fortinet's advisory and 9.8 by NVD. Same bug, two records, opposite sides of a severity boundary.\n\nIt is also the one SOCRadar tied to a campaign that infected 178 devices.\n\nIf two authorities disagree on the number, the number is not your sort key.", "url": "https://bsky.app/profile/bigg-thecreator.bsky.social/post/3mvl7cwswto27"}, {"timestamp": "2026-09-16T12:45:02.126Z", "date_only": false, "value": "2026-09-16T12:45:02.126140Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-rce-vulnerability-fortinet-fortios-and-fortiswitchmanager-patch-immediately", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "d0fad6f8-c8b0-439b-81f8-65aee934c8eb", "url": "https://ccb.belgium.be/advisories/warning-rce-vulnerability-fortinet-fortios-and-fortiswitchmanager-patch-immediately"}, {"timestamp": "2026-09-28T01:55:44.783Z", "date_only": false, "value": "2026-09-28T01:55:44.783683Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7imjsln2y", "record": "cve-2025-25249", "field": "creation_timestamp", "uuid": "138b8d8a-0213-4955-92e3-b5638e1fc899", "content": "CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability\n\nA heap-based buffer overflow in Fortinet FortiOS, FortiS\u2026\n\nhttps://planetbriefing.com/events/cve-2025-25249-fortinet-multiple-products-heap-based-buffer-overflow-vulnerabili-cd1be135a9d3\n\n#Technology #UnitedStates", "url": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7imjsln2y"}, {"timestamp": "2026-10-05T07:57:14.148Z", "date_only": false, "value": "2026-10-05T07:57:14.148992Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mx4gxhix652z", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "8e614643-ce67-4432-9776-7b28f2608dc5", "content": "Age in the chart is based on the year in each CVE ID, not the disclosure date. MikroTik, Microsoft $MSFT and the Linux kernel had 3 entries each. The oldest IDs in this batch: CVE-2025-25249 (Fortinet), CVE-2025-39682 and CVE-2025-39964 (Linux kernel).", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mx4gxhix652z"}, {"timestamp": "2026-10-07T17:56:49.319Z", "date_only": false, "value": "2026-10-07T17:56:49.319Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-25249", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-07T18:17:13.180Z", "date_only": false, "value": "2026-10-07T18:17:13.180", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25249", "record": "FKIE_CVE-2025-25249", "field": "lastModified"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-864900", "record": "SSA-864900", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T12:42:29.213Z", "date_only": false, "value": "2026-10-13T12:42:29.213332Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxr2muja2k24", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "4168f026-acfd-49f8-bf55-b9879c09cea9", "content": "Fortinet\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u8106\u5f31\u6027\u304cPivotC2 RAT\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u308b\n\nSOCRadar\u306e\u5831\u544a\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u8005\u306fFortinet\u88fd\u54c1\u306e\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3066\u3001Node.js\u30d9\u30fc\u30b9\u306eRAT\u3092\u5c55\u958b\u3057\u3066\u3044\u308b\u3002\n\nCVE-2025-25249\uff08CVSS\u30b9\u30b3\u30a27.4\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u554f\u984c\u3068\u3057\u3066\u8aac\u660e\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u91cd\u5927\u5ea6\u306e\u9ad8\u3044\u30d0\u30b0\u306f\u30011\u6708\u306bFortiOS\u3068FortiSwitchManager\u3067\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002\n\nFortinet\u306f\u52e7\u544a\u306e\u4e2d\u3067\u3001\u300c\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u304c\u3001\u7279\u5225\u306b\u7d30\u5de5\u3055\u308c\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4ecb\u3057...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxr2muja2k24"}, {"timestamp": "2026-10-13T13:14:51.588Z", "date_only": false, "value": "2026-10-13T13:14:51.588723Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxr4gr7n3s24", "record": "CVE-2025-25249", "field": "creation_timestamp", "uuid": "d2edd1bc-f3c5-477c-be5a-d595e5fde459", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Cisco\u3001Google Chromium V8\u3001Fortinet\u3001Citrix NetScaler\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001 \u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0 \u306b\u4ee5\u4e0b\u306e\u8106\u5f31\u6027 \u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\nCVE-2025-25249  Fortinet\u8907\u6570\u88fd\u54c1\u306b\u304a\u3051\u308b\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\nCVE-2026-19490  Citrix NetScaler\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\uff08\u4ee3\u66ff\u30d1\u30b9\u307e\u305f\u306f\u30c1...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxr4gr7n3s24"}, {"timestamp": "2026-10-15T01:05:48.869Z", "date_only": false, "value": "2026-10-15T01:05:48.869Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-25249", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T01:05:48.869Z", "date_only": false, "value": "2026-10-15T01:05:48.869Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / siemens-SADP", "record": "CVE-2025-25249", "field": "containers.adp.1.providerMetadata.dateUpdated"}]}