Fortinet FortiWeb Zero-Day Exploited to Gain Full Admin Access

A critical zero-day vulnerability in Fortinet FortiWeb has been actively exploited in the wild, allowing attackers to gain complete administrator access without any prior authentication.

The flaw affects Fortinet’s Web Application Firewall, which is designed to protect web applications from malicious traffic.

Vulnerability Discovery and Exploitation

On October 6, 2025, cyber deception company Defused published a proof-of-concept exploit captured by their Fortinet FortiWeb Manager honeypot.

The vulnerability enables threat actors to achieve administrator-level access to the FortiWeb Manager panel and the websocket command-line interface with no existing credentials or permissions required.

According to information shared by Defused, exploitation has been occurring in the wild since October 2025 through targeted attacks.

Security researchers at Rapid7 confirmed that the public exploit successfully compromises FortiWeb version 8.0.1, released in August 2025, but fails against the latest version 8.0.2.

The vulnerability poses significant risks to organizations running vulnerable versions of FortiWeb.

When successfully exploited against version 8.0.1, attackers can create malicious local administrator accounts, granting them complete control over the security appliance.

Rapid7’s testing demonstrated the successful creation of an administrator account named “hax0r” with full access privileges.

On November 6, 2025, Rapid7 Labs observed an alleged zero-day exploit targeting FortiWeb being sold on a popular black-hat forum. However, it remains unclear whether it relates to the same vulnerability.

The vulnerability affects FortiWeb versions before 8.0.2. Testing confirms version 8.0.1 is exploitable using the public proof-of-concept.

In contrast, version 8.0.2 returns a “403 Forbidden” response when exploitation is attempted.

However, whether version 8.0.2 intentionally includes a silent patch or coincidentally breaks the exploit remains uncertain without vendor confirmation.

As of November 13, 2025, Fortinet has not issued official guidance or assigned a CVE identifier for this vulnerability.

Organizations running vulnerable FortiWeb versions should take immediate emergency action by either updating to version 8.0.2 or removing FortiWeb management interfaces from public internet exposure.

Security teams should continuously monitor Fortinet’s official PSIRT feed for vendor guidance, even after updating to version 8.0.2.

Given that exploitation has been ongoing since October and broad-scale attacks are anticipated, organizations must prioritize remediation on an emergency basis.

The lack of official vendor acknowledgment raises concerns about the vulnerability’s scope and proper mitigation steps.

Until Fortinet provides comprehensive guidance, organizations should implement defense-in-depth measures to protect their FortiWeb deployments from potential compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.