# Fortinet FortiOS cw_acd Flaw Added to CISA KEV

Published: 2026-09-10 · Severity: high · Sectors: technology, telecommunications
Canonical: https://vorant.io/reports/e6349ebe-db5e-542c-86c4-29e7bf3e8612/fortinet-fortios-cw-acd-flaw-added-to-cisa-kev

> An unauthenticated heap-based buffer overflow in the cw_acd daemon of FortiOS (FortiSASE, FortiSwitchManager) allows remote code execution and is now listed on CISA's Known Exploited Vulnerabilities catalog.

NCSC-NL issued an advisory for CVE-2025-25249, a heap-based buffer overflow / out-of-bounds write vulnerability in the cw_acd daemon present in specific Fortinet FortiOS deployments, namely FortiSASE and FortiSwitchManager. The flaw can be triggered remotely by unauthenticated attackers who send specially crafted packets or requests to the vulnerable daemon, potentially resulting in arbitrary code or command execution on the affected system. This gives an attacker a path to full compromise of exposed devices without needing credentials.

On 9 September 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. NCSC-NL urges organizations to apply Fortinet's released updates immediately and to inspect internet-reachable, vulnerable systems for indicators of compromise or exploitation attempts. The CVSSv3 base score is 8.1. No specific threat actor, malware family, or IOC set was disclosed in this advisory; defenders should prioritize patching and network exposure review for FortiSASE and FortiSwitchManager instances.

## Mentioned in this report

- Vulnerabilities: CVE-2025-25249 (KEV)

## Detection guidance (public sample)

### FortiOS cw_acd Unexpected Child Process Execution

ATT&CK: T1190

Detects suspicious child process spawning from the cw_acd daemon following an exploitation attempt, indicating potential arbitrary code execution after successful buffer overflow. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS cw_acd Unexpected Child Process Execution
description: Detects cw_acd daemon spawning unexpected child processes such as shells,
  command interpreters, or system utilities after receiving network requests. This
  behavioural pattern is consistent with successful heap buffer overflow exploitation
  leading to arbitrary code execution.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: fortios
detection:
  selection_parent:
    ParentImage|endswith: cw_acd
  selection_suspicious_child:
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/ash
    - /usr/bin/curl
    - /usr/bin/wget
    - /usr/bin/nc
    - /usr/bin/netcat
  filter_known_child:
    Image|endswith:
    - /usr/lib/cw_acd
  condition: selection_parent and selection_suspicious_child and not filter_known_child
falsepositives:
- Legitimate FortiOS maintenance or diagnostic scripts invoking shell subprocesses
- Third-party integrations that intentionally spawn child processes from cw_acd
level: high
id: 78d091c1-3d52-5afe-a3f0-45dbdc37015c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0015.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6349ebe-db5e-542c-86c4-29e7bf3e8612/fortinet-fortios-cw-acd-flaw-added-to-cisa-kev.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup