Loading vulnerability…
Hard-coded credentials in FortiWeb internal Redis services
CVE-2025-59669 is a use of hard-coded credentials vulnerability in the internal Redis services of Fortinet FortiWeb. Affected versions include FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, and FortiWeb 7.0 all versions. The flaw allows an attacker who already has authenticated shell access on the device to use embedded credentials to connect to running internal Redis instances and access the data stored there. The issue stems from reliance on fixed credentials for an internal service rather than unique, protected secrets.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows access to internal Redis data on the affected FortiWeb appliance. This can expose sensitive application or operational data stored in Redis and may undermine internal trust boundaries on the device. Based on the available information, the documented impact is unauthorized access to Redis service data by an attacker who already has authenticated shell access.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict and monitor shell access to FortiWeb appliances, minimize the number of administrative users with device-level access, and enforce strong operational controls around privileged access. Limit opportunities for attackers to obtain authenticated shell access, segment management access paths, and monitor for unexpected interaction with internal services such as Redis. No specific vendor workaround beyond applying updates is available in the provided information.
Patch, then assume compromise.
Apply Fortinet security updates for affected FortiWeb releases. The vulnerable versions are FortiWeb 7.6.0, all 7.4 versions, all 7.2 versions, and all 7.0 versions; organizations should upgrade to a vendor-fixed release identified in Fortinet's security guidance for CVE-2025-59669.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.