CVE-2025-25257: FortiWeb unauthenticated SQL injection via HTTP requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with CVSS 9.8, active KEV listing, public exploits and near-maximum EPSS make this an urgent patch-first issue.

What it is

FortiWeb versions 7.0.0 through 7.6.3 contain a CWE-89 SQL injection flaw that lets an unauthenticated attacker run unauthorized SQL code or commands through crafted HTTP or HTTPS requests. Because it is remotely reachable without credentials and rated CVSS 9.8, it is a severe pre-auth issue for internet-facing FortiWeb deployments.

Impact

An attacker can execute arbitrary SQL statements and commands on the appliance, potentially reading or altering its database and underlying system. Full compromise of confidentiality, integrity and availability is possible per the CVSS vector.

Attack surface

Reached over the network via crafted HTTP or HTTPS requests to the FortiWeb appliance; the CVSS vector shows no privileges required and no user interaction. Any internet-exposed management or service interface is the likely entry point.

Exploitation

CVE-2025-25257 was added to CISA KEV on 2025-07-18 with a 2025-08-08 remediation due date, and public exploit references exist on Exploit-DB and Packet Storm. EPSS is 0.99775 (99.955th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Fortinet FortiWeb update referenced in advisory FG-IR-25-151 for your branch (7.0, 7.2, 7.4, 7.6).
• If patching cannot be done immediately, follow the vendor mitigation guidance or discontinue use of the exposed product per CISA BOD 22-01.
• Remove FortiWeb management and service interfaces from direct internet exposure and restrict access to trusted networks.
• Audit and rotate any credentials or secrets stored on or reachable from the appliance, assuming possible database or command access.
• Monitor Fortinet PSIRT and CISA KEV for updated guidance and confirm remediation by the 2025-08-08 due date.

Detection

• Inspect HTTP/HTTPS request logs and WAF/IDS alerts for SQL injection patterns targeting FortiWeb endpoints.
• Review FortiWeb and backend database logs for unexpected SQL statements, errors, or command execution around the time of suspicious requests.
• Hunt for anomalous outbound connections or new processes on the appliance that could indicate post-exploitation activity.
• Correlate network traffic to FortiWeb management interfaces from untrusted sources and alert on any such access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.