FortiWeb (< 7.2.11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fortiweb--7.2.11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 05:56:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFortinet FortiWeb: Unauthenticated SQL injection leading to remote code execution (CVE-2025-25257)https://feed.craftedsignal.io/briefs/2026-11-fortiweb-rce/Sun, 01 Nov 2026 05:56:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortiweb-rce/A critical unauthenticated SQL injection vulnerability (CVE-2025-25257) in FortiWeb allows remote code execution, with public exploit code now available.Fortinet FortiWeb is affected by a critical vulnerability (CVE-2025-25257) that enables unauthenticated SQL injection, which can be leveraged to achieve remote code execution. Proof-of-concept exploitation code is publicly available, allowing for identification and potential compromise of unpatched systems. Patches are available in FortiWeb versions 7.0.11, 7.2.11, 7.4.8, and 7.6.4.

Impact

Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the target appliance with full system impact (CVSS 9.8).

Recommendation

  • Upgrade all FortiWeb instances to the patched versions immediately: 7.0.11, 7.2.11, 7.4.8, or 7.6.4.
  • Review network logs for requests to the FortiWeb appliance containing unusual SQL patterns or shell command sequences.
  • Restrict access to the management interface of FortiWeb to known, trusted administrative IP addresses.
]]>criticaladvisorysqlircenetwork-appliance