Skip to content
Product
Use it
Threat intelligence API
Free key, 70+ endpoints, OpenAPI. The product.
Get started
Pick your stack, make your first call.
Live feed
The console: incidents, filters, entities, search.
Recipes
Runnable examples for the free key.
Free feeds
RSS, ransomware feed, IOC blocklist, MISP — no key.
CLI & agents
tc from a terminal; agent keys with scoped budgets.
The data
Incident records
900 articles a day become ~70 scored incidents.
Dark web
First-party leak-site collection: victims, groups, markets.
Validated IOCs
Indicators with a false-positive gate; STIX, MISP, CSV.
Vulnerabilities
CVEs with EPSS, KEV and exploit status.
Entity graph
Actors, malware, CVEs, companies — pivotable.
For teams
For service providers
Per-client feeds, alerts and branded digests.
Use cases
How teams and builders use the corpus.
About ThreatCluster
What it is and how it is built.
Pricing
Docs
Reference
OpenAPI (Swagger)
Every endpoint, parameter and response model.
ReDoc
The same reference, long-form.
Examples on GitHub
curl, Python and Node quickstarts; daily spec snapshot.
Guides
Quickstart & plans
Key, scopes, budgets, tiers.
Integrations
Splunk, Sentinel, Elastic, agents and terminals, step by step
Export formats
STIX 2.1, MISP, CSV, text.
CLI setup
Install, log in, wire an agent.
No results found
Sign in
Get a free key
No results found
Product
Threat intelligence API
Get started
Live feed
Recipes
Free feeds
CLI & agents
The data
Incident records
Dark web
Validated IOCs
Vulnerabilities
Entity graph
For teams
For service providers
Use cases
About ThreatCluster
Docs
OpenAPI (Swagger)
ReDoc
Examples on GitHub
Quickstart & plans
Integrations
Export formats
CLI setup
Pricing
Contact
Get a free key
Sign in
Back
FortiWeb
Vulnerability
Threat entity extracted from intelligence sources
Oct 13: 0 mentions
Oct 14: 1 mention
Oct 15: 2 mentions
Oct 16: 0 mentions
Oct 17: 0 mentions
Oct 18: 0 mentions
Oct 19: 0 mentions
Oct 13
Oct 16
Oct 19
Entities
›
vulnerability
›
FortiWeb
Frequency
89
occurrences
First Seen
November 13, 2025
Last Seen
October 15, 2026
API
Overview
Recent Events
Profile
Profile
MITRE ATT&CK
1 / 2
Exploited By
Volt Typhoon
Silent Lynx
TAG-193
Akira
Associated Malware
Coathanger
React2Shell
VenomRAT
Warmcookie
Bumblebee
Danabot
Elysium
Hijackloader
Tools Used
FortiWeb Authentication Bypass Artifact Generator
Laplas
Metasploit
PowerShell
FoalShell
Auto.js
Detection Artifact Generator
FOFA
Related CVEs
CVE-2026-24858
CVE-2026-26035
CVE-2026-1731
CVE-2026-70465
CVE-2026-70468
MITRE Techniques
T1190 - Exploit Public-Facing Application
T1059 - Command and Scripting Interpreter
T1078 - Valid Accounts
T1021 - Remote Services
T1059.001 - PowerShell
T1136 - Create Account
T1566 - Phishing
T1068 - Exploitation for Privilege Escalation
Campaigns
Break The Silence
Break The Silence: Kazakhstan-Nexus UAT-6275 Targets Government And Energy Organizations Across The CIS
Break The Silence: Tracking Silent Lynx Through Exposed Infrastructure
IndonesianFoods Npm Spam Campaign
Operation Endgame
Affected Platforms
FortiOS
FortiProxy
FortiSwitchManager
FortiCloud
FortiManager
FortiAnalyzer
Regions
United States
Uzbekistan
Armenia
Belarus
Australia
Sectors Affected
Government
Healthcare
Retail
Agriculture
Consulting
Energy
-
REC
Recon
No techniques detected
-
RD
Resource Dev
No techniques detected
3
IA
Initial Access
T1190 - Exploit Public-Facing Application
T1078 - Valid Accounts
T1566 - Phishing
1
EX
Execution
T1059 - Command and Scripting Interpreter
2
PE
Persistence
T1136 - Create Account
T1505.003 - Web Shell
1
PE
Priv Esc
T1068 - Exploitation for Privilege Escalation
-
DE
Defense Evasion
No techniques detected
1
CA
Cred Access
T1110 - Brute Force
-
DI
Discovery
No techniques detected
1
LM
Lateral Mov
T1021 - Remote Services
-
CO
Collection
No techniques detected
-
C2
C2
No techniques detected
-
EX
Exfil
No techniques detected
-
IM
Impact
No techniques detected
9
techniques detected across
6
tactics
Related Clusters (25)
Fortinet FortiWeb Zero-Day Vulnerability Exploited for Admin Account Hijacking
Nov 14
·
4 sources
82
FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation
Nov 15
·
100 sources
80
Multiple Critical CVEs Exploited in Cybersecurity Attacks
Sep 7
·
100 sources
75
FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection
Jun 17
·
0 sources
73
Fortinet FortiWeb Vulnerabilities Enable Potential Takeover
Aug 14
·
3 sources
73
TAG-193 Targets Central Asian Governments in Espionage Campaign
4d ago
·
3 sources
73
Critical Vulnerabilities in Fortinet Products Allow Unauthorized Access
Aug 14
·
1 sources
72
Multiple Vulnerabilities in FortiCloud SSO Authentication Exposed
Jun 22
·
0 sources
72
Metasploit Framework Targets FortiWeb Zero-Day Vulnerabilities
Nov 22
·
3 sources
58
Multiple Vulnerabilities Discovered in Cybersecurity Software
Nov 18
·
19 sources
50
Fortinet Addresses Critical Vulnerabilities in Key Products
Dec 12
·
9 sources
47
Fortinet FortiWeb CVE-2025-64446 Exploited for Admin Takeover
Dec 16
·
3 sources
47
Fortinet Addresses Critical Vulnerabilities in Multiple Products
Jan 14
·
6 sources
45
Metasploit Adds Exploit for FortiWeb 0-Day Vulnerabilities
Nov 22
·
3 sources
40
Fortinet Addresses Critical SSO Authentication Bypass Vulnerabilities
Dec 10
·
3 sources
40
Fortinet Confirms Exploitation of FortiCloud SSO Bypass Vulnerability
Jan 23
·
35 sources
38
Multiple Vulnerabilities Discovered in Cybersecurity Software
Nov 18
·
3 sources
34
Critical Vulnerabilities in Fortinet FortiWeb Actively Exploited
Nov 28
·
74 sources
33
Fortinet Issues Urgent Update for Critical WAF Vulnerability
Nov 30
·
2 sources
33
IndonesianFoods Worm Floods npm with Over 100,000 Spam Packages
Nov 13
·
4 sources
27
Netcraft Predicts Cybersecurity Trends for 2026
Dec 11
·
2 sources
24
Over 25,000 Fortinet Devices Vulnerable to Attacks via FortiCloud SSO
Dec 22
·
2 sources
18
Cyber Attacks by Ransomware Groups Target Major Organizations
Nov 24
·
3 sources
8
EchoGram Attack Bypasses AI Guardrails
Nov 17
·
3 sources
7
CBO Cyber Attack and Everest Ransomware Claims
Nov 10
·
1 sources
7
Prev
1 / 5
Next
Related Articles (50)
CVE-2025-25257
fortiguard.fortinet.com
·
3d ago
Tag193 Regional Espionage Operations
www.recordedfuture.com
·
3d ago
TAG-193's Regional Espionage Operations
Recordedfuture
·
4d ago
CVE-2025
Sploitus
·
Sep 8
CVE-2026-26035
www.fortiguard.com
·
Aug 14
Fortinet FortiWeb-Schwachstellen ermöglichen Übernahme
Borncity
·
Aug 14
Fortinet FortiWeb: Attackers can log in with any credentials
Heise.De
·
Aug 14
FG-IR-25-647
fortiguard.fortinet.com
·
Jun 22
FG-IR-25-647
www.fortiguard.com
·
Jun 22
FG-IR-26-060
www.fortiguard.com
·
Jun 22
FG IR 25 910
www.fortiguard.com
·
Jun 17
FG IR 25 513
fortiguard.fortinet.com
·
Jun 17
Link
edge.prnewswire.com
·
Apr 20
SIEM Rules for detecting exploitation of vulnerabilities in FortiCloud SSO
Kaspersky
·
Feb 5
Fortinet faces second authentication flaw in a fortnight
Sdxcentral
·
Jan 31
3,280,081 Fortinet Devices Online With Exposed Web Properties Under Risk
Cybersecuritynews
·
Jan 30
Fortinet’s latest zero
Cyberscoop
·
Jan 28
Fortinet confirms new zero
Csoonline
·
Jan 23
Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass
Bleepingcomputer
·
Jan 2
Over 25,000 FortiCloud SSO devices exposed to remote attacks
Bleepingcomputer
·
Dec 19
CISA: Multiple Fortinet Products Exploited In Attacks, Rapid Patching Urged
Crn
·
Dec 16
Fortinet FortiWeb Vulnerability (CVE-2025-64446) Exploited in the Wild for Full Admin Takeover
Cybersecuritynews
·
Dec 16
Critical Vulnerabilities in Multiple Fortinet Products
Csa.Sg
·
Dec 12
Netcraft Identifies Five Trends Poised to Redefine Cybersecurity in 2026
Prnewswire
·
Dec 11
Netcraft Identifies Five Trends Poised to Redefine Cybersecurity in 2026
Morningstar
·
Dec 11
Fortinet admins urged to update software to close FortiCloud SSO holes
Csoonline
·
Dec 11
Fortinet Patches Critical Authentication Bypass Vulnerabilities
Feeds.Feedburner
·
Dec 10
CC-4724
Digital.Nhs.Uk
·
Dec 10
Ivanti patches Endpoint Manager flaw allowing remote code execution
Computing
·
Dec 10
Fortinet warns of critical FortiCloud SSO login auth bypass flaws
Bleepingcomputer
·
Dec 9
Fortinet customers told to update immediately following major security issue - here's what we know
Msn
·
Nov 30
24th November
Research.Checkpoint
·
Nov 24
Metasploit Framework Updated With Exploit for FortiWeb Zero-Day
Cyberpress
·
Nov 22
Metasploit Adds Exploit Module for Recently Disclosed FortiWeb 0
Cybersecuritynews
·
Nov 22
CISA warns of actively exploited FortiWeb flaw.
Thecyberwire
·
Nov 22
Metasploit Releases New Exploit for Fresh FortiWeb 0-Day Vulnerabilities
Gbhackers
·
Nov 22
Active Exploitation of Vulnerability in FortiWeb
Csa.Sg
·
Nov 21
Many Fortinet Security Updates, Renewed Attacks on FortiWeb
Heise.De
·
Nov 20
Fortinet criticized for ‘silent’ patching after disclosing second zero
Csoonline
·
Nov 20
Fortinet unearths second FortiWeb firewall vulnerability in as many weeks
Sdxcentral
·
Nov 20
CISA and FortiGuard Warn of New FortiWeb Vulnerability Exploit - RS Web Solutions (RSWEBSOLS)
Rswebsols
·
Nov 20
Researchers warn command injection flaw in Fortinet FortiWeb is under exploitation
Cybersecuritydive
·
Nov 20
Fortinet hit again by zero-day vulnerability in FortiWeb
Techzine.Eu
·
Nov 20
Fortinet confirms second 0-day in just four days
Theregister
·
Nov 19
Fortinet 'fesses up to second 0
Theregister
·
Nov 19
CISA Urges Quick Fortinet Patches Amid Exploitation Of New FortiWeb Vulnerability
Crn
·
Nov 19
CISA gives govt agencies 7 days to patch new Fortinet flaw
Bleepingcomputer
·
Nov 19
FortiWeb 0-Day Code Execution Vulnerability Exploited in the Wild
Cyberpress
·
Nov 19
CISA Alerts on Fortinet FortiWeb Vulnerability Exploited in Real
Gbhackers
·
Nov 19
CC-4720 - Exploitation of Fortinet FortiWeb Vulnerability CVE-2025
Digital.Nhs.Uk
·
Nov 19
Prev
1 / 10
Next
Related Entities
Volt Typhoon
Silent Lynx
TAG-193
Zero-day Exploit
Malware
Data Breach
Ransomware
Phishing
Brute Force
Trojan
Sql Injection
Botnet