Security researchers have observed mass exploitation of an undisclosed FortiWeb vulnerability in the wild.
Security researchers have observed mass exploitation of an undisclosed FortiWeb vulnerability in the wild.
The following platforms are known to be affected:
Security researchers are reporting the following versions of FortiWeb as vulnerable:
Mass Exploitation Observed
Security researchers at CERT Orange Cyberdefense have reported mass exploitation of an undisclosed authentication bypass vulnerability in the Fortinet FortiWeb management console, first observed in October 2025.
Researchers at watchTowr have also released a "detection artifact generator" that can easily be modified into a proof-of-concept exploit. The NHS England National CSOC assesses further exploitation as highly likely.
Security researchers at PwnDefend and Defused have reported zero-day exploitation of an authentication bypass vulnerability in the management console of Fortinet FortiWeb appliances. Successful exploitation allows a remote, unauthenticated attacker to conduct a path traversal attack to create new administrator users in the management console.
Affected organisations are strongly encouraged to follow the remediation steps detailed below.
Note: This cyber alert will be updated when Fortinet releases an official advisory. Organisations are strongly encouraged to monitor the Fortinet PSIRT Advisories webpage for security updates affecting the Fortinet products in use on their estate.
Security researchers at CERT Orange Cyberdefense have analysed a public proof-of-concept exploit and determined the following versions are unaffected .
Affected organisations are strongly encouraged to update Fortinet FortiWeb to one of the following versions as soon as possible.
Reportedly fixed versions:
Affected organisations are encouraged to restrict access to management consoles for network security appliances, including FortiWeb, to known, trusted access points. Organisations are strongly encouraged to disable access to the management console from the internet.
Last edited: 14 November 2025 1:42 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
