CISA Warns of Fortinet FortiWeb SQL Injection Vulnerability Exploited in Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet FortiWeb vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of the SQL injection flaw in cyberattacks worldwide.<\/p>\n
The vulnerability, tracked as CVE-2025-25257, affects Fortinet\u2019s FortiWeb web application firewall and carries a severe CVSS score of 9.6 out of 10.<\/p>\n
The vulnerability arises from improper neutralization of special elements used in SQL commands, allowing unauthenticated attackers to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.<\/p>\n
\u201cAn improper neutralization of special elements used in an SQL command (\u2018SQL Injection\u2019) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,\u201d Fortinet explained in its advisory.<\/a><\/p>\n The vulnerability resides in FortiWeb\u2019s Fabric Connector component, which serves as a bridge between the firewall and other Fortinet security products.<\/p>\n Security researchers discovered that attackers can exploit the flaw by sending malicious requests to the Cybersecurity monitoring organization The Shadowserver Foundation has identified widespread exploitation of the vulnerability, reporting 77 compromised FortiWeb instances as of July 15, 2025. This represents a slight decrease from 85 compromised systems detected the previous day.<\/p>\n\/api\/fabric\/device\/status<\/code> endpoint with crafted Authorization headers.<\/p>\nActive Exploitation Campaign<\/strong><\/h2>\n