ZERO-DAY ATTACK WARNING: Fortinet FortiWeb Exploit Grants Unauthenticated Admin Access!

Cybersecurity firms have highlighted a critical Fortinet FortiWeb vulnerability that allows an unauthenticated attacker to gain administrator-level control of the FortiWeb Manager panel, with a public PoC exploit already in circulation and active exploitation observed since October 2025. The story begins on 6 October 2025, when Defused reported a PoC that created a new administrator-level FortiWeb Manager account via a crafted HTTP POST, granting instant access to the websocket CLI.

Rapid7 has tested the exploit on multiple FortiWeb versions, showing the PoC working against FortiWeb 8.0.1 released in August 2025, while the same exploit fails against the latest FortiWeb 8.0.2 release; it remains unclear whether 8.0.2 includes a fix or if the PoC was altered. There is no official Fortinet PSIRT advisory or CVE identifier published for this issue at the time of writing, and on 6 November 2025 watchTowr noted a FortiWeb zero-day exploit for sale on a black hat forum.

Organisations running pre-8.0.2 FortiWeb versions are urged to remediate by updating to FortiWeb 8.0.2 and to remain vigilant for unusual admin account creation and odd management API requests. according to Rapid7 Labs.