Back fortiguard.fortinet.com

CVE-2025-25257

fortiguard.fortinet.com • October 15, 2026

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Fortinet has observed this to be exploited in the wild on FortiWeb.

Disable HTTP/HTTPS administrative interface

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating remote access. The campaigns have affected entities in nine countries, including Kazakhstan, Kyrgyzstan, and Russia, with phishing emails containing decoy documents related to diplomatic and trade matters. Silent Lynx, first reported in 2025, is believed to be linked to broader operations targeting critical infrastructure in Central Asia. Cisco Talos and Recorded Future are tracking these activities under the identifiers UAT-6275 and TAG-193. The threat actor has been active since at least 2020 and is suspected to have connections with other clusters like YoroTrooper. As of now, the exploitation of the WinRAR flaw is confirmed in the wild. 1 sources 81

Extracted Entities

CVE-2025-25257

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Vulnerabilities (1)