Do Son Threat actor uses React2Shell to deploy Sliver C2 on FortiWeb devices, using a Bangladesh Airforce decoy to target govt and financial sectors.
FortiWeb
CISA added a FortiWeb RCE flaw (CVE-2025-58034) to its KEV Catalog due to active exploitation. The bug allows authenticated attackers to execute arbitrary code on the WAF via crafted requests. Update now.
Cybersecurity firms warn of a Critical, actively exploited FortiWeb flaw that allows unauthenticated attackers to create a new administrator account on the FortiWeb Manager panel. Update to v8.0.2 immediately.
CISA added CVE-2025-25257, a critical FortiWeb SQL injection vulnerability (CVSS 9.6), to its KEV Catalog, confirming active exploitation in the wild. Update immediately!
Fortinet released a critical patch for FortiWeb (CVE-2025-25257). This unauthenticated SQL injection flaw allows remote code execution. PoC Releases!
Fortinet released a critical patch for FortiWeb (CVE-2025-25257, CVSS 9.6). This unauthenticated SQL injection flaw allows remote code execution; update immediately!