InfoSecBulletin Cybersecurity for mankind
Fortinet has issued a critical patch for a critical vulnerability in its FortiWeb product, a web application firewall commonly used in enterprises. Identified as CVE-2025-25257, this high-severity issue is an unauthenticated SQL injection flaw that lets remote attackers run unauthorized SQL commands through specially crafted HTTP or HTTPS requests.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” Fortinet stated in its advisory.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
The issue, with a CVSS score of 9.6, is critical as it doesn’t require authentication to exploit, making it an attractive target for attackers.
If not fixed, the vulnerability allows attackers to access sensitive data, change database content, or compromise backend systems.
For organizations that can’t upgrade right away, Fortinet suggests disabling the HTTP/HTTPS administrative interface as a temporary workaround:
“Disable HTTP/HTTPS administrative interface,” the advisory recommends, as this interface is the primary attack vector.
However, disabling the GUI interface may limit manageability and is not considered a permanent solution. Organizations are strongly urged to apply the vendor-supplied patches.
Fortinet is pleased to thank Kentaro Kawane from GMO Cybersecurity by Ierae for reporting this vulnerability under responsible disclosure.
