Fortinet FortiWeb Zero-Day Exploited to Gain Full Admin Access

A critical zero-day vulnerability in Fortinet FortiWeb has been actively exploited in the wild, allowing attackers to gain complete administrator access without any prior authentication. On 6 October 2025, cyber deception company Defused published a public proof-of-concept exploit captured by their Fortinet FortiWeb Manager honeypot, with exploitation reportedly ongoing in targeted attacks since October 2025.

Security researchers at Rapid7 confirmed that the public exploit successfully compromises FortiWeb version 8.0.1, released in August 2025, but fails against the latest version 8.0.2, with an administrator account such as “hax0r” able to be created during testing. On 6 November 2025, Rapid7 Labs observed an alleged zero-day exploit being sold on a popular black-hat forum, though it remains unclear if it relates to the same vulnerability.

Fortinet has not issued an official CVE identifier as of 13 November 2025, and organisations running FortiWeb should update to 8.0.2 or remove FortiWeb management interfaces from public internet exposure while monitoring Fortinet’s PSIRT guidance.