Fortinet FortiOS/FortiSwitchManager Heap Buffer Overflow Enabling Remote Code Execution

Fortinet disclosed a critical heap-based buffer overflow (CWE-122) in the cw_acd daemon affecting FortiOS and FortiSwitchManager, which can allow remote, unauthenticated attackers to execute arbitrary code or commands via specially crafted network traffic. Impacted versions span multiple FortiOS branches (6.4 through 7.6), along with FortiSASE and FortiSwitchManager releases; Fortinet advised immediate upgrades (e.g., FortiOS 7.6.4+, 7.4.9+, 7.2.12+, 7.0.18+, 6.4.17+; FortiSwitchManager 7.2.7+ and 7.0.6+), and noted FortiSASE 25.2.b is remediated in 25.2.c. The issue was reported as discovered internally by Fortinet’s product security team, and public reporting indicated no CVE was initially listed at publication time.

Separately, Fortinet also disclosed a low-severity SSRF in FortiSandbox tracked as CVE-2025-67685 (FG-IR-25-783), where an authenticated, high-privilege user can craft GUI-driven HTTP requests to proxy traffic to internal plaintext endpoints (CWE-918). While this SSRF could enable internal service exposure or pivoting in segmented environments, it requires privileged access and was not reported as actively exploited; Fortinet recommended upgrading FortiSandbox (e.g., 5.0.5+ for 5.0.0–5.0.4) and migrating off legacy 4.x branches. For the FortiOS/FortiSwitchManager RCE, interim mitigations included removing fabric access from interfaces and restricting CAPWAP-CONTROL (UDP 5246–5249) to trusted sources via local-in policies.