Article Details
Scrape Timestamp (UTC): 2025-11-14 09:07:54.257
Source: https://thehackernews.com/2025/11/fortinet-fortiweb-flaw-actively.html
Original Article Text
Click to Toggle View
Fortinet FortiWeb Flaw Actively Exploited in the Wild Before Company's Silent Patch. Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet Fortiweb WAF that could allow an attacker to take over admin accounts and completely compromise a device. "The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet's FortiWeb product," Benjamin Harris, watchTowr CEO and founder, said in a statement. "Patched in version 8.0.2, the vulnerability allows attackers to perform actions as a privileged user - with in-the-wild exploitation focusing on adding a new administrator account as a basic persistence mechanism for the attackers." The cybersecurity company said it was able to successfully reproduce the vulnerability and create a working proof-of-concept (Poc). It has also released an artifact generator tool for the authentication bypass to help identify susceptible devices. According to details shared by Defused and security researcher Daniel Card of PwnDefend, the threat actor behind the exploitation has been found to send a payload to the "/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi" by means of an HTTP POST request to create an admin account. Some of the admin usernames and passwords created by the payloads detected in the wild are below - The origins and identity of the threat actor behind the attacks remain unknown. The exploitation activity was first detected early last month. As of writing, Fortinet has not assigned a CVE identifier or published an advisory on its PSIRT feed. The Hacker News has reached out to Fortinet for comment, and we will update the story if we hear back. Rapid7, which is urging organizations running versions of Fortinet FortiWeb that predate 8.0.2 to address the vulnerability on an emergency basis, said it observed an alleged zero-day exploit targeting FortiWeb was published for sale on a popular black hat forum on November 6, 2025. It's currently not clear if it's the same exploit. "While we wait for a comment from Fortinet, users and enterprises are now facing a familiar process now: look for trivial signs of prior compromise, reach out to Fortinet for more information, and apply patches if you haven't already," Harris said. "That said, given the indiscriminate exploitation observed [...], appliances that remain unpatched are likely already compromised."
Daily Brief Summary
A critical authentication bypass flaw in Fortinet's FortiWeb was exploited in the wild before a silent patch was issued in version 8.0.2.
Attackers can leverage this vulnerability to take over admin accounts, compromising the entire device by adding new administrator accounts.
The exploitation involves sending a payload via an HTTP POST request to a specific endpoint, allowing unauthorized admin account creation.
The origins of the threat actor exploiting this vulnerability remain unknown, with activity first detected early last month.
Fortinet has not yet assigned a CVE identifier or released an official advisory, raising concerns about vulnerability management and communication.
Rapid7 advises immediate patching of FortiWeb versions prior to 8.0.2, as unpatched devices are at high risk of being compromised.
The vulnerability's details were reportedly sold on a black hat forum, complicating the threat landscape for enterprises using FortiWeb.
Organizations are urged to check for signs of compromise and contact Fortinet for further guidance while applying necessary patches.