New Fortinet FortiWeb hacks likely linked to public RCE exploits

Impact

For European organizations, the impact of this threat could be substantial. FortiWeb devices are commonly deployed in enterprise environments, government agencies, and critical infrastructure sectors across Europe to protect web-facing applications. A successful RCE attack could lead to unauthorized access to sensitive data, disruption of web services, and potential lateral movement within corporate networks. This could result in data breaches affecting personal data protected under GDPR, causing regulatory penalties and reputational damage. Additionally, compromised FortiWeb devices could be used to launch further attacks such as web application tampering, injection of malicious payloads, or as part of botnets for distributed denial-of-service (DDoS) attacks. The threat is particularly concerning for sectors with high-value targets such as finance, healthcare, and public administration, where web applications are critical and often contain sensitive information. The absence of confirmed exploits in the wild suggests that proactive mitigation is still possible to prevent widespread impact.