Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025

CVE-2025-20281 is an injection flaw (CWE-74) in a specific API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker can trigger it by sending a crafted request to that API; no valid credentials or user interaction are required. A successful exploit yields arbitrary code execution on the underlying operating system with root privileges, giving the attacker full control of the affected device (scope-changing per the CVSS 10.0 score). Any organization running affected ISE or ISE-PIC releases is exposed, particularly where the vulnerable API is reachable from untrusted networks. The flaw is confirmed under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-28, EPSS assigns a 97.1% probability of exploitation within 30 days, and ZDI has published a writeup of the unauthenticated root RCE.

Do: Upgrade Cisco ISE and ISE-PIC to the patched releases specified in Cisco's PSIRT advisory, and check whether the vulnerable API/admin interface is reachable from untrusted networks, restricting access until patching is complete. As a KEV entry added 2025-07-28, U.S. federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product; given EPSS of 97.1% and confirmed active exploitation, prioritize internet-facing ISE instances and review API/web-server logs for signs of exploitation.

A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

CVE-2025-25257 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) in Fortinet's FortiWeb web application firewall, affecting FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. It can be triggered by an unauthenticated remote attacker sending crafted HTTP or HTTPS requests to the appliance, with no user interaction or credentials required. Successful exploitation lets the attacker execute unauthorized SQL commands or code on the device, and publicly released proof-of-concept exploits chain the flaw to remote code execution on the appliance. Any organization running an affected FortiWeb version is exposed, and because FortiWeb appliances are typically deployed at the network edge to protect web applications, internet-facing deployments are the most likely targets. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-18 and carries a 99.8% EPSS score with two public PoC exploits, so defenders should treat it as actively exploited.

Do: Upgrade FortiWeb to the latest patched build for your branch (7.0.x, 7.2.x, 7.4.x, or 7.6.x) per Fortinet's advisory, or apply the vendor's mitigations; federal agencies must follow the BOD 22-01 requirements tied to the KEV listing. Until patched, limit internet exposure of FortiWeb interfaces and review device and WAF logs for signs of exploitation, since public PoC exploits and the KEV addition on 2025-07-18 indicate active use.