Fortinet FortiWeb: Unauthenticated SQL injection leading to remote code execution (CVE-2025-25257)
A critical unauthenticated SQL injection vulnerability (CVE-2025-25257) in FortiWeb allows remote code execution, with public exploit code now available.
CVE search metadata
CVE search record: CVE-2025-25257. Severity: critical. CVSS: 9.8. EPSS: 99.92%. KEV: no. Product: FortiWeb (< 7.0.11), FortiWeb (< 7.2.11), FortiWeb (< 7.4.8), FortiWeb (< 7.6.4). Brief: Fortinet FortiWeb: Unauthenticated SQL injection leading to remote code execution (CVE-2025-25257). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortiweb-rce/
Triage facts
Revision 1- Applicability
- FortiWeb (< 7.0.11), FortiWeb (< 7.2.11) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 1, 05:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
Fortinet FortiWeb is affected by a critical vulnerability (CVE-2025-25257) that enables unauthenticated SQL injection, which can be leveraged to achieve remote code execution. Proof-of-concept exploitation code is publicly available, allowing for identification and potential compromise of unpatched systems. Patches are available in FortiWeb versions 7.0.11, 7.2.11, 7.4.8, and 7.6.4.
Impact
Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the target appliance with full system impact (CVSS 9.8).
Recommendation
- Upgrade all FortiWeb instances to the patched versions immediately: 7.0.11, 7.2.11, 7.4.8, or 7.6.4.
- Review network logs for requests to the FortiWeb appliance containing unusual SQL patterns or shell command sequences.
- Restrict access to the management interface of FortiWeb to known, trusted administrative IP addresses.
Immediate actions
Patch all FortiWeb instances to versions 7.0.11, 7.2.11, 7.4.8, 7.6.4 or above
Threat Hunt
Inspect web server logs for suspicious SQL injection patterns followed by outbound shell execution or connection attempts (e.g., /bin/bash)
Data: Web application access logs, FortiWeb diagnostic/audit logs
Mitigations
Upgrade FortiWeb firmware
CVE-2025-25257