Loading story…
A critical path traversal vulnerability in Fortinet FortiWeb has been actively exploited by threat actors to create unauthorized administrative accounts on exposed devices without authentication. The flaw, which affects FortiWeb versions 8.0.1 and earlier, allows attackers to send specially crafted HTTP POST requests to a vulnerable endpoint, resulting in the creation of admin-level users with known usernames and passwords. Security researchers have observed a global increase in exploitation attempts, with attacks originating from a wide range of IP addresses and targeting unpatched systems.
Fortinet has released a fix in version 8.0.2 and urges administrators to update immediately and check for signs of unauthorized access. Public proof-of-concept (PoC) code and exploitation tools have been released, further increasing the risk to organizations that have not yet applied the patch. Security firms, including Defused and watchTowr Labs, have confirmed the exploit and provided guidance and detection tools to help defenders identify and remediate vulnerable devices.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Security reporting stated that proof-of-concept exploit code for the FortiWeb vulnerability was publicly available and that attackers were actively exploiting the issue in the wild to create admin users on exposed devices.
A vulnerability in Fortinet FortiWeb was identified that allows attackers to create administrator users without authentication, effectively granting full administrative access to affected systems. Public reporting indicates the flaw was being treated as a zero-day at the time of disclosure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability in Fortinet FortiWeb web application firewalls has been actively exploited in the wild, allowing unauthenticated attackers to create new administrator accounts and fully compromise affected devices. The flaw, which was silently patched in version 8.0.2, enables attackers to send crafted HTTP POST requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi`) to add privileged users. Security researchers from watchTowr, Defused, and Rapid7 have confirmed exploitation attempts since early October, with proof-of-concept exploits and detection tools now publicly available. The vulnerability has not yet been assigned a CVE, and Fortinet has not released an official advisory or comment as of the latest reports. Organizations running FortiWeb versions prior to 8.0.2 are urged to update immediately or restrict public access to the management interface. Security teams should check for unauthorized admin accounts and investigate for potential compromise if their systems have been exposed since early October. The identity of the threat actors remains unknown, but the attacks are widespread and indiscriminate, targeting internet-facing FortiWeb devices. Researchers have published indicators of compromise and recommended urgent mitigation steps to prevent further exploitation.
Jun 29, 2026
A critical vulnerability, CVE-2025-64446, affecting Fortinet FortiWeb web application firewall devices has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, present in FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and earlier branches, allows unauthenticated remote attackers to bypass authentication and execute administrative commands via crafted HTTP or HTTPS requests. Attackers have leveraged this vulnerability to create unauthorized administrative accounts, such as "Testpoint" and "trader," enabling persistent and undetected access to affected systems. Fortinet has released patches in version 8.0.2 and equivalent updates, but exploitation continues against unpatched devices, exposing organizations to significant risk of compromise and data exposure. CISA's inclusion of CVE-2025-64446 in the KEV catalog underscores the urgency of remediation, especially for U.S. federal agencies, which have been mandated to patch vulnerable FortiWeb systems by November 21, 2025. The agency also strongly advises all organizations to prioritize remediation of this and other KEV-listed vulnerabilities to reduce exposure to active cyber threats. The vulnerability's exploitation highlights the ongoing risk posed by unpatched perimeter security devices and the importance of timely vulnerability management in defending against sophisticated attacks.
Jun 29, 2026
A critical zero-day vulnerability in Fortinet's FortiWeb Web Application Firewall (WAF), tracked as CVE-2025-64446, has been actively exploited by threat actors since early October 2025. The flaw, which combines a path traversal and authentication bypass, allows attackers to create malicious administrative accounts and execute privileged actions on vulnerable FortiWeb devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply patches by November 21, 2025. The vulnerability affects multiple FortiWeb versions, including 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11, and is being exploited in the wild to gain unauthorized administrative access. Security briefings and technical reports confirm that attackers are leveraging crafted HTTP or HTTPS requests to exploit the flaw, enabling them to bypass authentication and perform administrative actions. The exploitation campaign has prompted urgent patching advisories and highlights the ongoing risk posed by unpatched WAF appliances in enterprise environments. While the identity of the threat actors remains unknown, the rapid weaponization of this vulnerability underscores the importance of timely patch management and monitoring for suspicious administrative account creation on FortiWeb devices.
Jun 29, 2026