Fortinet FortiOS: Heap-based buffer overflow in cw_acd daemon

Summary

A heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Fortinet describes the flaw as affecting the Security Fabric/CAPWAP handling of this daemon, which is used to centrally manage wireless access points. NVD rates the vulnerability as critical with CVSS 9.8, while Fortinet rates it 8.1, and CISA lists it as known exploited since 2026-09-09. Any FortiGate with the 'fabric' service enabled on an affected version, especially on internet-facing interfaces, should be treated as urgent.

Affected

• FortiOS 7.6.0 to 7.6.3
• FortiOS 7.4.0 to 7.4.8
• FortiOS 7.2.0 to 7.2.11
• FortiOS 7.0.0 to 7.0.17
• FortiOS 6.4 (all versions)
• FortiSwitchManager 7.2.0 to 7.2.6
• FortiSwitchManager 7.0.0 to 7.0.5

Source: Fortinet advisory FG-IR-25-084. The CVE record lists different version ranges; the vendor advisory is used here.

Fixed in

• FortiOS 7.6.4 or above
• FortiOS 7.4.9 or above
• FortiOS 7.2.12 or above
• FortiOS 7.0.18 or above
• FortiSwitchManager 7.2.7 or above
• FortiSwitchManager 7.0.6 or above
• FortiOS 6.4: Unknown. The advisory says 'Migrate to a fixed release'.
• FortiSASE: fixed in 25.2.c and 25.1.b, no customer action required.

Workaround

• Remove the 'fabric' service from the allowed access of all interfaces (for example set allowaccess ssh https).
• Alternatively, block CAPWAP-CONTROL (UDP 5246 to 5249) with a local-in policy that permits only trusted CAPWAP devices on interfaces where fabric is enabled.
• These workarounds do not replace the update.

Exploitation

• CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2026-09-09.
• SOCRadar reports active exploitation linked to the PivotC2 post-exploitation RAT.
• Public proof-of-concept code: Unknown.
• CISA SSVC: exploitation active, not automatable, total technical impact.

Our recommendation

• Update FortiOS and FortiSwitchManager to the fixed versions above without delay.
• If patching is not possible immediately, apply the workarounds.
• Check all FortiGate devices for the 'fabric' service on internet-facing interfaces and reduce exposure.
• Review logs for signs of compromise, unexpected administrator accounts and configuration changes.
• Replace FortiOS 6.4 devices with a supported release, as no fixed 6.4 version is confirmed.
• Monitor the vendor advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fortinet PSIRT FG-IR-25-084 fortiguard.fortinet.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• SOCRadar: PivotC2 FortiGate RAT socradar.io
• Qualys ThreatPROTECT: FortiOS and FortiSwitchManager code execution threatprotect.qualys.com
• Siemens SSA-864900 cert-portal.siemens.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:55.