Critical FortiWeb flaw under attack, allowing complete compromise

Fortinet FortiWeb is facing an actively exploited authentication bypass flaw that enables attackers to hijack admin accounts and take full control of devices, with Fortinet releasing version 8.0.2 to address the issue.

The vulnerability was publicly disclosed after Defused shared a proof of concept on 6 October 2025, following real attack attempts observed by its honeypot. watchTowr Labs has confirmed the FortiWeb exploit and released a video PoC, and a tool named the FortiWeb Authentication Bypass Artifact Generator was also made available to attempt to create an admin account.

Defused and researcher Daniel Card report that attackers are exploiting the flaw by sending a crafted HTTP POST request to the endpoint /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi to create a new admin account. On 6 November 2025 Rapid7 Labs noted the sale of an alleged zero-day exploit targeting FortiWeb on a black hat forum, though it remains unclear if this is the same exploit described by researchers.