Critical Fortinet FortiWeb SQL injection vulnerability actively exploited
Take action: If you have Fortinet FortiWeb systems running versions 7.0 through 7.6.3, time to act NOW. Make sure it's web admin interface is isolated from the internet and accessible from trusted networks. Then plan a VERY QUICK patch, there is an exploit PoC public and hackers are actively attacking the systems.
Learn More
Security researchers report active exploitation of the vulnerability affecting FortiWeb web application firewall.
The flaw is tracked as CVE-2025-25257 (CVSS score 9.6), is caused by improper neutralization of special elements used in SQL commands, creating an unauthenticated SQL injection weakness that allows remote attackers to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.
Security researchers detected attacks that are sending malicious requests to the /api/fabric/device/status endpoint with specially crafted Authorization headers. The vulnerability is exploited via a a function called get_fabric_user_by_token within FortiWeb's httpsd service, which fails to properly sanitize Bearer tokens from HTTP Authorization headers before incorporating them into SQL queries.
Exploitation of the vulnerability began on July 11, 2025, on the same day with the public release of proof-of-concept exploit code by watchTowr Labs. The Shadowserver Foundation has been monitoring the exploitation campaign and reported 85 compromised FortiWeb instances on July 14, which decreased slightly to 77 on July 15, then further dropped to 35 by July 18, 2025.
United States accounts for the highest number of compromised devices at 40 instances, followed by the Netherlands, Singapore, and the United Kingdom.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the active exploitation by adding CVE-2025-25257 to its Known Exploited Vulnerabilities (KEV) catalog. CISA strongly urges all organizations to prioritize remediation of this vulnerability.
