Security Advisory:
FortiWeb Authentication Bypass, CVE-2025-52970
(AKA FortMajeure)

What We Know

Fortinet has released patches for a vulnerability in its FortiWeb Web Application Firewall (WAF) tracked as CVE-2025-52970. Exploitation allows an unauthenticated attacker to log in as any existing user on the device via a specially crafted request. Of note, a partial proof of concept and detailed explanation of the vulnerability exists publicly, and exploitation in the wild is expected.

If exploited, an attacker may be granted the opportunity to create persistent access to an environment as well as potentially execute code on the host. CyberMaxx urges upgrading affected versions to their latest patch level to ensure protection against exploitation.

Affected Versions

More Reading / Information

• https://fortiguard.fortinet.com/psirt/FG-IR-25-448