#fortiweb — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #fortiweb, aggregated by home.social.
-
Bitte schnell die betroffenen Systeme aktualisieren und sich einen neuen Hersteller des Vertrauens suchen... z.B. #CheckPoint 🫳 🎤
#Fortinet #FortiCloud #FortiOS #FortiManager #FortiWeb #FortiProxy #FortiAnalyzer #Sicherheitsluecke #EUVD_2026_4712 #CVE_2026_24858
-
FortiSIEM pod ostrzałem – krytyczna luka w zabezpieczeniach odkryta
Czy narzędzie, które ma patrzeć wszystkim na ręce, może samo stać się najsłabszym ogniwem? FortiSIEM – centrum nerwowe wielu SOC-ów – właśnie dostało strzał prosto w mechanizm zaufania.
Czytaj dalej:
https://pressmind.org/fortisiem-pod-ostrzalem-krytyczna-luka-w-zabezpieczeniach-odkryta/#PressMindLabs #cve202564155 #fortinet #fortisiem #fortiweb #phmonitor
-
[VULN] ⚠️Fortinet : encore une faille zero-day dans FortiWeb (CVE-2025-58034)
"Il y a quelques jours, Fortinet a dévoilé une première faille de sécurité zero-day dans FortiWeb : CVE-2025-64446. Dans le sillage de cette première vulnérabilité, une seconde faille de sécurité zero-day a été patchée par l'éditeur américain. Il s'agit d'une faiblesse de type "injection de commande au niveau de l'OS" qu'un attaquant peut exploiter en étant authentifié.
Fortinet précise qu'elle peut "permettre à un attaquant authentifié d'exécuter du code non autorisé sur le système sous-jacent via des requêtes HTTP ou des commandes CLI spécialement conçues."
👇
https://www.it-connect.fr/fortinet-cve-2025-58034-encore-une-faille-zero-day-dans-fortiweb/"Multiple OS command injection in API and CLI"
👇
https://fortiguard.fortinet.com/psirt/FG-IR-25-513 -
Fortinet Issues Fixes as FortiWeb Takeover Flaw Sees Active Attacks https://hackread.com/fortinet-fixes-fortiweb-takeover-flaw-active-attacks/ #Cybersecurity #Vulnerability #CyberAttack #Security #Fortinet #FortiWeb #CISA
-
Fortinet Issues Fixes as FortiWeb Takeover Flaw Sees Active Attacks https://hackread.com/fortinet-fixes-fortiweb-takeover-flaw-active-attacks/ #Cybersecurity #Vulnerability #CyberAttack #Security #Fortinet #FortiWeb #CISA
-
🚨 Fortinet has released patches for two actively exploited vulnerabilities in its #FortiWeb web-application firewalls. One allows full takeover, the other enables command injection.
Update now: https://hackread.com/fortinet-fixes-fortiweb-takeover-flaw-active-attacks/
-
🚨 Fortinet has released patches for two actively exploited vulnerabilities in its #FortiWeb web-application firewalls. One allows full takeover, the other enables command injection.
Update now: https://hackread.com/fortinet-fixes-fortiweb-takeover-flaw-active-attacks/
-
Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week https://www.securityweek.com/fortinet-discloses-second-exploited-fortiweb-zero-day-in-a-week/ #Vulnerabilities #vulnerability #exploited #Featured #Fortinet #FortiWeb #ZeroDay
-
Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week https://www.securityweek.com/fortinet-discloses-second-exploited-fortiweb-zero-day-in-a-week/ #Vulnerabilities #vulnerability #exploited #Featured #Fortinet #FortiWeb #ZeroDay
-
Fortinet Silent Patch Raises Concern Among Security Researchers https://thecyberexpress.com/fortinet-silent-patch-raises-concern/ #WebApplicationFirewalls #webapplicationsecurity #FortinetVulnerability #TheCyberExpressNews #TheCyberExpress #Vulnerabilities #FirewallDaily #cyberattacks #CyberNews #FortiWeb #CISA
-
Fortinet Silent Patch Raises Concern Among Security Researchers https://thecyberexpress.com/fortinet-silent-patch-raises-concern/ #WebApplicationFirewalls #webapplicationsecurity #FortinetVulnerability #TheCyberExpressNews #TheCyberExpress #Vulnerabilities #FirewallDaily #cyberattacks #CyberNews #FortiWeb #CISA
-
CVE Alert: CVE-2025-58034 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-58034-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-58034 #fortinet #fortiweb
-
CVE Alert: CVE-2025-58034 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-58034-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-58034 #fortinet #fortiweb
-
CVE Alert: CVE-2025-64446 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-64446-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-64446 #fortinet #fortiweb
-
CVE Alert: CVE-2025-64446 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-64446-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-64446 #fortinet #fortiweb
-
The narrative about #FortiWeb (CVE-2025-64446) exploitation is going to end up being about attacker behavior and compromise, which is fair enough, except that this looks to have been entirely preventable.
How are we still letting suppliers get away with silent patches in frequently exploited products in 2025? Customers need to be voting for better supplier behavior with their wallets, or with their legal teams.
https://www.vulncheck.com/blog/fortinet-forti-web-exploitation-hits-silently-patched-vulnerability
-
The narrative about #FortiWeb (CVE-2025-64446) exploitation is going to end up being about attacker behavior and compromise, which is fair enough, except that this looks to have been entirely preventable.
How are we still letting suppliers get away with silent patches in frequently exploited products in 2025? Customers need to be voting for better supplier behavior with their wallets, or with their legal teams.
https://www.vulncheck.com/blog/fortinet-forti-web-exploitation-hits-silently-patched-vulnerability
-
⚠️ Exploitation des Fortinet FortiWeb <8.0.2 en cours
Faille critique de contournement d’authentification : un attaquant distant peut créer un compte administrateur et prendre le contrôle complet du WAF.
📌 Versions affectées (selon watchTowr) :
8.0 : versions antérieures à 8.0.2
7.6 : versions antérieures à 7.6.5
7.4 : versions antérieures à 7.4.10
7.2 : versions antérieures à 7.2.12
7.0 : versions antérieures à 7.0.12
6.4 : versions ≤ 6.4.3
6.3 : versions ≤ 6.3.23🔧 Mitigation :
➡️ Il est recommandé d’utiliser une version corrigée (8.0.2+ / dernière version de votre branche).
➡️ Il est également préférable que l’interface d’admin ne soit pas exposée sur Internet, avec un accès limité à des IP de confiance et/ou via VPN.Analyse technique & détection :
👇
https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/Outil de génération d’artefacts (détection/PoC défense) :
📜 👇 https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass?tab=readme-ov-fileContexte exploitation in the wild :
🔗 🐦 https://x.com/watchtowrcyber/status/1989017336632996337 -
Krytyczna luka w Fortinet FortiWeb używana do ataków. Paczujcie się
Kolejny groźny atak na puszki od Fortineta — upewnijcie się, że Wasz FortiWeb jest w wersji 8.0.2 zanim doczytacie ten artykuł do końca.
Wystawiono exploita na sprzedaż i już widać ataki
6 listopada wystawiono na sprzedaż exploita na FortiWeb (Web Application Firewall).
źródło: Rapid7.com
Exploit pozwala atakującemu założyć sobie konto z uprawnieniami administratora (!) w panelu zarządzania FortiWeb. Atak działa na wersje FortiWeb 8.0.1 i wcześniejsze.Nie ma jeszcze CVE i producent nie wydał pełnego komunikatu, ale wygląda na to, że po cichu załatał błąd w 8.0.2. Co ciekawe, PoC na tę lukę został opublikowany już 6 października przez firmę Defused, po tym jak wykryli atak w swoim honeypocie.
Krótko mówiąc, załatajcie się, a jak nie możecie, ściągnijcie webinterfejs WAF-a z internetu. Albo postawcie przed nim innego WAF-a ;Phttps://niebezpiecznik.pl/post/krytyczna-luka-w-fortinet-fortiweb-uzywana-do-atakow-paczujcie-sie/
-
Krytyczna luka w Fortinet FortiWeb używana do ataków. Paczujcie się
Kolejny groźny atak na puszki od Fortineta — upewnijcie się, że Wasz FortiWeb jest w wersji 8.0.2 zanim doczytacie ten artykuł do końca.
Wystawiono exploita na sprzedaż i już widać ataki
6 listopada wystawiono na sprzedaż exploita na FortiWeb (Web Application Firewall).
źródło: Rapid7.com
Exploit pozwala atakującemu założyć sobie konto z uprawnieniami administratora (!) w panelu zarządzania FortiWeb. Atak działa na wersje FortiWeb 8.0.1 i wcześniejsze.Nie ma jeszcze CVE i producent nie wydał pełnego komunikatu, ale wygląda na to, że po cichu załatał błąd w 8.0.2. Co ciekawe, PoC na tę lukę został opublikowany już 6 października przez firmę Defused, po tym jak wykryli atak w swoim honeypocie.
Krótko mówiąc, załatajcie się, a jak nie możecie, ściągnijcie webinterfejs WAF-a z internetu. Albo postawcie przed nim innego WAF-a ;Phttps://niebezpiecznik.pl/post/krytyczna-luka-w-fortinet-fortiweb-uzywana-do-atakow-paczujcie-sie/
-
Better late than never — we’ve just published the July Vulnerability Report.
👉 https://www.vulnerability-lookup.org/2025/08/23/vulnerability-report-july-2025/
📌 Key highlights:
The most reported vulnerability this month is CVE-2025-53770, a critical flaw in #Microsoft SharePoint Enterprise Server 2016, with more than 400 sightings.
Other high-impact issues include CVE-2025-5777 (#NetScaler ADC) and CVE-2025-25257 (#Fortinet #FortiWeb.
-
CVE Alert: CVE-2025-25257 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-25257-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-25257 #fortinet #fortiweb
-
CVE Alert: CVE-2025-25257 - Fortinet - FortiWeb - https://www.redpacketsecurity.com/cve-alert-cve-2025-25257-fortinet-fortiweb/
#OSINT #ThreatIntel #CyberSecurity #cve-2025-25257 #fortinet #fortiweb
-
Fortinet's FortiWeb has a hidden flaw: a cookie glitch that lets attackers forge admin access. How could a tiny parameter turn into a massive security risk? Dive into the details and learn how to protect your system now.
#fortimajeure
#fortiweb
#cybersecurity
#vulnerability
#authenticationbypass -
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication – Source: www.securityweek.com https://ciso2ciso.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #vulnerabilities #securityweekcom #securityweek #Exploited #Fortinet #FortiWeb
-
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication – Source: www.securityweek.com https://ciso2ciso.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #vulnerabilities #securityweekcom #securityweek #Exploited #Fortinet #FortiWeb
-
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication https://www.securityweek.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication/ #Vulnerabilities #exploited #Fortinet #FortiWeb
-
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication https://www.securityweek.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication/ #Vulnerabilities #exploited #Fortinet #FortiWeb
-
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication https://www.securityweek.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication/ #Vulnerabilities #exploited #Fortinet #FortiWeb
-
Fortinet FortiWeb Flaw Exploited in the Wild After PoC Publication https://www.securityweek.com/fortinet-fortiweb-flaw-exploited-in-the-wild-after-poc-publication/ #Vulnerabilities #exploited #Fortinet #FortiWeb
-
FortiWeb взломан изнутри: SQL-инъекция 9.6/10 позволяет писать код в БД
В компоненте Fabric Connector (интеграция продуктов Fortinet) обнаружена (https://fortiguard.fortinet.com/psirt/FG-IR-25-151) критическая уязвимость CVE-2025-25257 (9.6/10 CVSS). Атакующий без авторизации мог:
→ Выполнять произвольные SQL-запросы через поддельный Bearer-токен в заголовке Authorization;
→ Использовать SELECT... INTO OUTFILE для записи вредоносного кода на диск;
→ Запускать код через Python, получая полный контроль над системой (от имени пользователя mysql).Уязвимые версии:
FortiWeb 7.6.0–7.6.3, 7.4.0–7.4.7, 7.2.0–7.2.10, 7.0.0–7.0.10.
Решение: Срочно обновиться до 7.6.4, 7.4.8, 7.2.11 или 7.0.11. До патча — отключить веб-интерфейсы HTTP/HTTPS.Как починили?
Fortinet заменила небезопасные форматные строки на подготовленные выражения (prepared statements), блокирующие SQL-инъекции. Уязвимость нашёл Кентаро Кавана (GMO Cybersecurity) — эксперт по взлому Cisco. -
Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.
For more information, visit http://crowdsec.net
Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights.
📩 Sign up now for exclusive access: https://contact.crowdsec.net/threat-alert
🧵6/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.
For more information, visit http://crowdsec.net
Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights.
📩 Sign up now for exclusive access: https://contact.crowdsec.net/threat-alert
🧵6/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
🛡️ How to protect your systems:
🔹 Patch: Patch your FortiWeb instance if it is publicly exposed; otherwise, remove outside access to the affected admin panel.
🔹 Preemptive blocking: Use Crowdsec CTI to block IPs exploiting CVE-2025-25257 👉 https://app.crowdsec.net/cti?q=cves%3A%22CVE-2025-25257%22&page=1
🔹 Stay proactive: Install the Crowdsec Web Application Firewall to stay ahead of exploit attempts, with 100+ virtual patching rules available. 👉 https://doc.crowdsec.net/docs/next/appsec/intro🧵5/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
🛡️ How to protect your systems:
🔹 Patch: Patch your FortiWeb instance if it is publicly exposed; otherwise, remove outside access to the affected admin panel.
🔹 Preemptive blocking: Use Crowdsec CTI to block IPs exploiting CVE-2025-25257 👉 https://app.crowdsec.net/cti?q=cves%3A%22CVE-2025-25257%22&page=1
🔹 Stay proactive: Install the Crowdsec Web Application Firewall to stay ahead of exploit attempts, with 100+ virtual patching rules available. 👉 https://doc.crowdsec.net/docs/next/appsec/intro🧵5/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
📈 Trend analysis:
🔹 CrowdSec detected the first in-the-wild exploitation of this vulnerability on July 11th, shortly after we rolled out detection rules. Using our wayback tools, we were able to establish that there were no exploitation attempts before July 11th, confirming once again that public exploits are a key driver of vulnerability weaponization.
🔹 For CVE-2025-25257, CrowdSec has observed about 40 distinct IPs producing about 500 attack events in total. Most of these attacks occurred on Friday, July 11th, the day the exploit was publicized. The attacks on Friday were mainly due to a presumably coordinated attacker spinning up a bunch of machines on Scaleway cloud to use in a broad scanning campaign. Over the weekend, the exploit quickly lost popularity. This might be due to the fact that the exploit requires the Fabric Connector administrative interface to be publicly accessible, which is somewhat unlikely. While we cannot make predictions, CrowdSec expects exploitation signals to pick up slightly this week as vulnerability scanners start looking for vulnerable devices. However, we don’t expect the attacker volume for this vulnerability to reach that of other Fortinet-related CVEs.🧵4/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
📈 Trend analysis:
🔹 CrowdSec detected the first in-the-wild exploitation of this vulnerability on July 11th, shortly after we rolled out detection rules. Using our wayback tools, we were able to establish that there were no exploitation attempts before July 11th, confirming once again that public exploits are a key driver of vulnerability weaponization.
🔹 For CVE-2025-25257, CrowdSec has observed about 40 distinct IPs producing about 500 attack events in total. Most of these attacks occurred on Friday, July 11th, the day the exploit was publicized. The attacks on Friday were mainly due to a presumably coordinated attacker spinning up a bunch of machines on Scaleway cloud to use in a broad scanning campaign. Over the weekend, the exploit quickly lost popularity. This might be due to the fact that the exploit requires the Fabric Connector administrative interface to be publicly accessible, which is somewhat unlikely. While we cannot make predictions, CrowdSec expects exploitation signals to pick up slightly this week as vulnerability scanners start looking for vulnerable devices. However, we don’t expect the attacker volume for this vulnerability to reach that of other Fortinet-related CVEs.🧵4/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
🛠️ About the exploit:
🔹 The Fortinet FortiWeb Fabric Connector is an integration component designed to enhance application security by linking FortiWeb web application firewalls (WAFs) with other elements of the Fortinet Security Stack. It enables policy enforcement and automated threat response by leveraging intelligence gathered from FortiGate firewalls, FortiSandbox, FortiAnalyzer, and other “Fabric-enabled” devices. It is in some sense a glue product that holds an array of different Fortinet products together.
🔹 The vulnerability allows unauthenticated attackers to execute arbitrary SQL statements against the MySQL database connected to Fabric Connector. As this database runs as root per default, this attack can be chained to run arbitrary Python code on the affected machine, allowing attackers to further compromise the system. The vulnerability affects various FortiWeb versions from 7.0 to 7.6. As a workaround, the vendor recommends disabling the administrative interface to external visitors.🧵3/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
🛠️ About the exploit:
🔹 The Fortinet FortiWeb Fabric Connector is an integration component designed to enhance application security by linking FortiWeb web application firewalls (WAFs) with other elements of the Fortinet Security Stack. It enables policy enforcement and automated threat response by leveraging intelligence gathered from FortiGate firewalls, FortiSandbox, FortiAnalyzer, and other “Fabric-enabled” devices. It is in some sense a glue product that holds an array of different Fortinet products together.
🔹 The vulnerability allows unauthenticated attackers to execute arbitrary SQL statements against the MySQL database connected to Fabric Connector. As this database runs as root per default, this attack can be chained to run arbitrary Python code on the affected machine, allowing attackers to further compromise the system. The vulnerability affects various FortiWeb versions from 7.0 to 7.6. As a workaround, the vendor recommends disabling the administrative interface to external visitors.🧵3/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
-
⚠️ Key findings:
🔹 A new SQL injection vulnerability in a FortiWeb component allows attackers to execute arbitrary code on the affected machine.
🔹 CrowdSec has been tracking exploitation since the 11th of July 2025.
🔹 Data from the CrowdSec network indicates that attacker interest in the vulnerability remains very limited.🧵2/6
#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec
