CVE-2025-25257Vulnerability
Fortinet FortiWeb SQL Injection Vulnerability
Reported by 3 independent sources · first reported by SOCRadar · last reported
Last reported 9 days ago
Fix due 8 Aug 2025
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 18 Oct 2026
What the reports say
3 reports, newest first · the exact sentence from each-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“…es linked to the threat actor have been found to host Linux-compatible tooling and a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb, suggesting a possible expansion of the threat actor's operational capabilities.”
-
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations“We also recovered Linux-compatible tooling and a publicly available proof-of-concept exploit for FortiWeb CVE-2025-25257 from UAT-6275 infrastructure.”
-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“…E-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-25257).”
Indicators reported together
named in the same reports- 129.146.87[.]174in 1 report
- 130.12.182[.]216in 1 report
- db848d928afe4d2284a35bb112720e6fin 1 report
- 46.8.236[.]121in 1 report
- 24.106.41[.]154in 1 report
- 46.44.231[.]122in 1 report
- 213.96.47[.]74in 1 report
- 71.245.184[.]24in 1 report
- b2d46bfc25df83dd…c46257d13be8in 1 report
- e27f5b057a0de14ab32fb9e7462f04cfin 1 report
- 65d96bd51d8a1cbd…e9bd64103992in 1 report
- 3ba4e04fdcf73c267b89d91fc90f836fin 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2025-8088, CVE-2025-49113, CVE-2026-63030, CVE-2022-1040, CVE-2023-46747, CVE-2024-55591, CVE-2025-31324
Thanks — we review every report.