CVE-2025-25257

Exploited in the wild. In CISA KEV since 2025‑07‑18. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2025-07-18, due 2025-08-08
Public exploit: 4 sources FixVendor fixNo build named by the sources

Published 2025-07-17Updated 2026-02-20Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Fortinet FortiWebAffected: ≥ 7.6.0, ≤ 7.6.3Upgrade to: after 7.6.3Affected: ≥ 7.4.0, ≤ 7.4.7Upgrade to: after 7.4.7Affected: ≥ 7.2.0, ≤ 7.2.10Upgrade to: after 7.2.10Affected: ≥ 7.0.0, ≤ 7.0.10Upgrade to: after 7.0.10Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which FortiWeb version you are running (7.0.x, 7.2.x, 7.4.x, or 7.6.x).
If you're on 7.6.0–7.6.3, upgrade to 7.6.4 or above.
If you're on 7.4.0–7.4.7, upgrade to 7.4.8 or above.
If you're on 7.2.0–7.2.10, upgrade to 7.2.11 or above.
If you're on 7.0.0–7.0.10, upgrade to 7.0.11 or above.
If you cannot upgrade immediately, restrict access to the FortiWeb management/admin interface from the internet and follow Fortinet's advisory for interim mitigations.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

2 publishers

Exploitation reported in the wild
as reported · Oct 15, 2026·The Hacker News summary
Technical analysis published
as reported · Oct 14, 2026·Cisco Talos summary
Added to CISA KEV catalog
Jul 18, 2025·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

In plain language

Written by AI from the record

A critical, actively exploited flaw in Fortinet FortiWeb lets attackers with no login break into the system's database over the internet, and any business running FortiWeb should patch now.

Unauthenticated SQL injection (CWE-89) in Fortinet FortiWeb allows remote attackers to execute arbitrary SQL commands via crafted HTTP/HTTPS requests, with confirmed in-the-wild exploitation and public PoCs driving CISA KEV listing.

If you're affected

Full database compromise
Customer/application data exposure
Firewall bypass or disabling
Operational disruption
Follow-on network intrusion

What is it

FortiWeb is a firewall meant to protect your web applications and database from attackers. This flaw turns that protection inside-out: an outsider can send a specially crafted web request and have the firewall itself run unauthorized database commands — like a security guard who can be tricked into handing over the keys to the vault without showing any ID.

Who is affected

This matters to you if you run Fortinet FortiWeb, a web application firewall appliance, in versions 7.0.0–7.0.10, 7.2.0–7.2.10, 7.4.0–7.4.7, or 7.6.0–7.6.3. It is reachable directly over the network if the device's web interface is exposed to the internet or any untrusted network — no account or credentials are needed to exploit it.

How urgent is it

Attackers are already exploiting this vulnerability in the wild, and it is on CISA's Known Exploited Vulnerabilities list with a federal remediation deadline of August 8, 2025 — treat this as already under active attack. Public exploit code is also freely available, making attacks easy to replicate. This is a top-priority, act-now situation.

What to do — in detail

Confirm exposure by identifying all FortiWeb instances and checking whether their management/admin interfaces are reachable from the internet or untrusted networks — this flaw requires no authentication and no user interaction. Upgrade each instance to the fixed version for its branch: 7.0.11+, 7.2.11+, 7.4.8+, or 7.6.4+ (per Fortinet's advisory FG-IR-25-151). There is no documented SQL-level workaround beyond restricting network access to the admin/management interface until patched; disable public exposure of the interface if upgrade cannot happen immediately, per CISA's BOD 22-01 guidance for cloud-exposed devices. CISA's KEV remediation due date was August 8, 2025 — if not yet remediated, this is overdue. Monitor for anomalous database queries, unexpected admin accounts, or unusual outbound traffic from FortiWeb appliances, and review logs retroactively given confirmed active exploitation (actor UAT-6275 associated with this activity).

Technical context

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or interaction required, full compromise of confidentiality, integrity, and availability. Weakness: CWE-89 (SQL Injection) triggered via crafted HTTP/HTTPS requests to FortiWeb. Confirmed in CISA KEV (added 2025-07-18, due 2025-08-08), with 4 known public PoCs on GitHub indicating mature exploit tooling. Exploitation is confirmed, not merely predicted, superseding the (not independently cited here) EPSS signal.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2025-07-18.

US federal agencies must remediate by 2025-08-08.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

4 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 14 days before any public exploit.

2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → critical
2026-03-07Public exploit / PoCsource: github-poc
2026-03-06Nuclei check added
2026-02-20Patch availablerecord updated
2025-07-18Added to CISA KEV

Affected products

Fortinetcommercial · USaka forti net
- FortiWebSecurity Products
Fortinet Inc.commercial · USaka fortinet
- FortiWebSecurity Products

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable