Fortinet FortiOS cw_acd Flaw Added to CISA KEV
An unauthenticated heap-based buffer overflow in the cw_acd daemon of FortiOS (FortiSASE, FortiSwitchManager) allows remote code execution and is now listed on CISA's Known Exploited Vulnerabilities catalog.
NCSC-NL issued an advisory for CVE-2025-25249, a heap-based buffer overflow / out-of-bounds write vulnerability in the cw_acd daemon present in specific Fortinet FortiOS deployments, namely FortiSASE and FortiSwitchManager. The flaw can be triggered remotely by unauthenticated attackers who send specially crafted packets or requests to the vulnerable daemon, potentially resulting in arbitrary code or command execution on the affected system. This gives an attacker a path to full compromise of exposed devices without needing credentials.
On 9 September 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. NCSC-NL urges organizations to apply Fortinet's released updates immediately and to inspect internet-reachable, vulnerable systems for indicators of compromise or exploitation attempts. The CVSSv3 base score is 8.1. No specific threat actor, malware family, or IOC set was disclosed in this advisory; defenders should prioritize patching and network exposure review for FortiSASE and FortiSwitchManager instances.
Mentioned in this report
Detection guidance
FortiOS cw_acd Unexpected Child Process Execution
Detects suspicious child process spawning from the cw_acd daemon following an exploitation attempt, indicating potential arbitrary code execution after successful buffer overflow. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS cw_acd Unexpected Child Process Execution
description: Detects cw_acd daemon spawning unexpected child processes such as shells,
command interpreters, or system utilities after receiving network requests. This
behavioural pattern is consistent with successful heap buffer overflow exploitation
leading to arbitrary code execution.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: fortios
detection:
selection_parent:
ParentImage|endswith: cw_acd
selection_suspicious_child:
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/ash
- /usr/bin/curl
- /usr/bin/wget
- /usr/bin/nc
- /usr/bin/netcat
filter_known_child:
Image|endswith:
- /usr/lib/cw_acd
condition: selection_parent and selection_suspicious_child and not filter_known_child
falsepositives:
- Legitimate FortiOS maintenance or diagnostic scripts invoking shell subprocesses
- Third-party integrations that intentionally spawn child processes from cw_acd
level: high
id: 78d091c1-3d52-5afe-a3f0-45dbdc37015c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0015.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free