Loading story…
Fortinet FortiWeb has been hit by multiple serious vulnerabilities, including CVE-2025-58034, an authenticated OS command injection flaw, and CVE-2025-25257, a pre-authentication SQL injection issue in the Fabric Connector component that can lead to remote code execution. Reporting indicated the command injection bug was under active exploitation, while public advisories described the weakness as enabling attackers to execute operating system commands on affected appliances. The SQL injection flaw affects FortiWeb Fabric Connector versions across the 7.0 to 7.6.x range and is notable because exploitation does not require prior authentication.
Public exploit and detection material quickly emerged for CVE-2025-25257, with GitHub repositories publishing proof-of-concept code and exploitation demonstrations, alongside production-focused detection engineering content to help defenders identify abuse. The combination of active exploitation reporting, internet-facing exposure tracking, and readily available offensive tooling raises the risk for organizations using FortiWeb, particularly where management interfaces or vulnerable connector functionality are exposed.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
A public advisory was issued for CVE-2025-58034, describing an authenticated OS command injection vulnerability in Fortinet FortiWeb. Subsequent references tied the advisory to exploitation concerns around the product.
Cybersecurity Dive reported that a critical Fortinet FortiWeb vulnerability was being actively exploited in the wild. The article indicates exploitation activity had been observed by the time of publication.
Another GitHub repository for CVE-2025-25257 was released, further publicizing exploitation details for the FortiWeb flaw. The project described the issue as a secure pre-authenticated SQL injection affecting FortiWeb.
A GitHub repository providing production-ready detection engineering content for CVE-2025-25257 was published. It focused on helping defenders identify exploitation of the FortiWeb Fabric Connector SQL injection vulnerability.
A public GitHub repository for CVE-2025-25257 was published, demonstrating exploitation of a Fortinet FortiWeb vulnerability. The flaw was described as a pre-authentication SQL injection issue that could lead to remote code execution.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecensys.com
Open sourcecybersecuritydive.com
Open sourcecybersecuritydive.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2025-25257**, a pre-authentication SQL injection flaw in the **Fortinet FortiWeb Fabric Connector** that can be chained to achieve **remote code execution** on affected systems. Public write-ups from WatchTowr Labs and Summoning Team describe the issue as reachable without authentication, raising the risk that internet-exposed FortiWeb deployments could be compromised before defenders can intervene. The disclosures indicate the vulnerability affects the Fabric Connector component and allows an attacker to move from SQL injection to full code execution, potentially giving control over the appliance or its underlying environment. While the referenced materials provide limited remediation detail in the supplied content, the publication of technical research and exploit methodology increases the urgency for organizations using FortiWeb to identify exposed instances, review vendor guidance for **CVE-2025-25257**, and prioritize patching or mitigation.
Aug 1, 2026
Fortinet has disclosed multiple vulnerabilities in its FortiWeb web application firewall, including a critical OS command injection flaw tracked as CVE-2025-64446 and another actively exploited vulnerability, CVE-2025-58034. These vulnerabilities allow authenticated attackers to execute unauthorized code or commands on affected FortiWeb systems via crafted HTTP requests or CLI commands. Fortinet has observed exploitation of these flaws in the wild and has released security updates to address the issues, urging customers to upgrade to the latest versions to mitigate risk. The vulnerabilities impact several FortiWeb versions, and Fortinet has credited researchers from Trend Micro for responsible disclosure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded by mandating that all federal civilian agencies patch CVE-2025-64446 within seven days, highlighting the severity and active exploitation of the bug. Security researchers have noted that attackers are using HTTP POST requests to create new admin-level accounts on exposed devices, and CISA has recommended disabling HTTP/HTTPS on internet-facing interfaces if immediate patching is not possible. Fortinet has communicated directly with affected customers and emphasized the importance of prompt remediation to prevent further compromise of FortiWeb deployments.
Jul 23, 2026
Attackers are actively exploiting a command injection vulnerability in Fortinet FortiWeb, tracked as CVE-2025-58034, which allows authenticated users to execute unauthorized code on affected systems. The flaw, caused by improper neutralization of special elements in the `policy_scripting_post_handler` method, enables code execution as root via crafted HTTP requests or CLI commands. Fortinet released patches for affected FortiWeb versions between October 23 and 31, 2025, but did not publicly disclose the vulnerability at the time. The issue was privately reported by a Trend Micro researcher, and both Fortinet and CISA have confirmed active exploitation, with CISA adding the CVE to its Known Exploited Vulnerabilities catalog and mandating rapid remediation for US federal agencies. Security researchers warn that proof-of-concept code for CVE-2025-58034 may soon be publicly available, increasing the risk of widespread attacks. There is currently no workaround for this vulnerability, and organizations are urged to upgrade to the fixed FortiWeb versions immediately and check for signs of compromise. The vulnerability requires authentication to exploit, but successful exploitation grants attackers root-level access. The disclosure timeline shows the vulnerability was reported in June 2025 and publicly disclosed in November 2025, with coordinated advisories from both Fortinet and the Zero Day Initiative.
Jun 29, 2026