Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability
Source SecurityWeek
Rated Critical by Threat Radar from the SecurityWeek text
Data as of 18 Nov 2025, 01:09 UTC
What to do
AI-suggested
European organizations should immediately verify if they deploy FortiWeb appliances and identify affected versions. They must prioritize applying the latest Fortinet patches addressing this vulnerability, even if the vendor's communication has been quiet. In addition to patching, organizations should enhance network monitoring to detect unusual traffic patterns or indicators of compromise related to FortiWeb. Deploying web application security monitoring tools and enabling detailed logging on FortiWeb devices can aid in early detection of exploitation attempts. Network segmentation should be reviewed to limit lateral movement if a FortiWeb device is compromised. Organizations should also conduct threat hunting exercises focused on this vulnerability and related attack vectors. Incident response plans must be updated to include scenarios involving FortiWeb exploitation. Given the critical nature, organizations should consider temporary compensating controls such as restricting management interface access to trusted IPs and enforcing multi-factor authentication for administrative access. Collaboration with Fortinet support and sharing threat intelligence within industry groups can improve situational awareness and response effectiveness.
Description
Security firms say the flaw has been actively exploited for weeks, even as Fortinet quietly shipped fixes and CISA added the bug to its KEV catalog. The post Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability appeared first on SecurityWeek .