CVE-2025-25257: Fortinet FortiWeb SQL injection

CVE-2025-25257 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-07-18

FortiWeb is a web application firewall designed to protect corporate websites and applications from cyberattacks. A critical vulnerability has been identified that allows unauthorized individuals to run malicious database commands by sending specially crafted web traffic. This could lead to the theft of sensitive customer data, unauthorized modification of records, or a complete takeover of the security appliance. This vulnerability is reportedly being exploited in the wild.

Technologies: Fortinet FortiWeb. Vendors: Fortinet.

Quick answers

Is CVE-2025-25257 exploited in the wild?
Yes. CVE-2025-25257 is known to be exploited in the wild, first recorded on 18 July 2025. Treat it as urgent.
How severe is CVE-2025-25257?
Critical severity, with a CVSS score of 9.8, published 18 July 2025.
Which products and versions are affected?
Fortinet FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10.
Is there a fix for CVE-2025-25257?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-25257 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-25257?
Check whether you run Fortinet FortiWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in Fortinet FortiWeb due to improper neutralization of special elements used in SQL commands. The flaw can be triggered by an unauthenticated remote attacker sending specially crafted HTTP or HTTPS requests to the appliance. Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, or administrative bypass. The vulnerability affects multiple major versions including 7.0, 7.2, 7.4, and 7.6. This flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation.

Affected products

  • Fortinet FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10

Timeline

  • 2025-07-17: disclosed: Initial disclosure by Fortinet
  • 2025-07-18: advisory: NVD publication and CISA KEV addition
  • 2025-07-18: exploited: Added to CISA KEV catalog due to active exploitation

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.