9.6 Critical Exploited

CVE-2025-25257 Fortinet FortiWeb SQL Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-89

Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Affected products and versions

Product	Affected versions	Fixed in
FortiWeb 7.6	7.6.0 → 7.6.3	No fix stated
FortiWeb 7.4	7.4.0 → 7.4.7	No fix stated
FortiWeb 7.2	7.2.0 → 7.2.10	No fix stated
FortiWeb 7.0	7.0.0 → 7.0.10	No fix stated

References

fortiguard.fortinet.com fortiguard.fortinet.com

Timeline

Published July 17, 2025
Added to the KEV catalogue July 18, 2025
Last modified February 26, 2026

The 74 CVEs of FortiWeb →

CVE-2026-26035 An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb… 8.8 High CVE-2026-70466 A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through… 4.8 Medium CVE-2026-40688 An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0… 6.7 Medium CVE-2026-39811 A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6,… 4.4 Medium

Track this CVE