CVE-2025-25257

CVE-2025-25257 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) in Fortinet's FortiWeb web application firewall, affecting FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. It can be triggered by an unauthenticated remote attacker sending crafted HTTP or HTTPS requests to the appliance, with no user interaction or credentials required. Successful exploitation lets the attacker execute unauthorized SQL commands or code on the device, and publicly released proof-of-concept exploits chain the flaw to remote code execution on the appliance. Any organization running an affected FortiWeb version is exposed, and because FortiWeb appliances are typically deployed at the network edge to protect web applications, internet-facing deployments are the most likely targets. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-18 and carries a 99.8% EPSS score with two public PoC exploits, so defenders should treat it as actively exploited.

What to do: Upgrade FortiWeb to the latest patched build for your branch (7.0.x, 7.2.x, 7.4.x, or 7.6.x) per Fortinet's advisory, or apply the vendor's mitigations; federal agencies must follow the BOD 22-01 requirements tied to the KEV listing. Until patched, limit internet exposure of FortiWeb interfaces and review device and WAF logs for signs of exploitation, since public PoC exploits and the KEV addition on 2025-07-18 indicate active use.