FortiWeb Path Traversal Exploit Actively Targeted: What You Need to Know

A newly observed Fortinet FortiWeb vulnerability is a path traversal flaw that could enable an unauthenticated attacker to create a local administrator account by sending a crafted POST request to the API endpoint /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi, allowing full administrative access once forged. Active exploitation began around 6 October 2025, with honeypot data showing attacker activity evolving into broad scanning and credential planting against exposed FortiWeb instances worldwide.

Rapid7 testing indicates Fortinet FortiWeb version 8.0.2 blocks the attack, returning a 403 Forbidden response, while 8.0.1 and earlier remain vulnerable; Fortinet has not issued an official advisory or CVE ID at the time of publication, according to the article. SOCRadar’s dark web monitoring noted a post referencing the exploit on 3 November 2025, though verification is pending.

Shodan observations show over 700 publicly reachable FortiWeb instances, mainly in the United States, underscoring the risk of exposed management interfaces during active campaigns. Administrators are urged to upgrade to 8.0.2 or later, restrict public internet access to management interfaces, audit admin accounts, and monitor the Fortinet PSIRT feed for updates, according to the piece.