Back Isc.Sans.Edu Honeypot: FortiWeb CVE-2025-64446 Exploits, (Sat, Nov 15th)
Like many have reported, we too noticed exploit attempts for CVE-2025-64446 in our honeypots.
These are POST requests to this path:
With this User Agent String:
And this is the data of the POST request:
This creates a new admin user (profile: prof_admin).
You can find this JSON data back in this PoC .
Didier Stevens Senior handler blog.DidierStevens.com
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
