Fortinet FortiWeb Exploit Chain Allegedly Up For Sale On Criminal Forum
A threat actor operating under the handle Spaniard has advertised what they describe as a “one-day” remote code execution exploit chain targeting Fortinet FortiWeb, the vendor’s web application firewall used to shield web applications and APIs from application-layer attacks. According to the listing, the exploit affects FortiWeb 8.0.0 through 8.0.1 and chains two separate vulnerabilities to achieve unauthenticated remote code execution on the appliance. The seller claims the full chain is included, prices it at roughly 760 US dollars (negotiable), accepts Monero only, and restricts transactions to forum escrow or an approved middleman with contact by private message. The seller’s reliability, the quality of the code, and whether the buyer receives a working chain rather than a repackaged public exploit are all unverified.
Although the listing does not name the CVEs, its parameters align closely with a known, publicly documented FortiWeb chain. A “one-day” (post-patch) unauthenticated RCE built from two vulnerabilities against exactly FortiWeb 8.0.0–8.0.1 matches CVE-2025-64446 — a relative path-traversal / authentication-bypass flaw that lets an unauthenticated attacker execute administrative commands (including creating a rogue administrator account) — chained with CVE-2025-58034, an authenticated OS-command-injection flaw. Both were fixed in FortiWeb 8.0.2, so 8.0.0 and 8.0.1 are precisely the vulnerable builds. CVE-2025-64446 (CVSS 9.1–9.8) and CVE-2025-58034 (CVSS 6.7) are both in CISA’s Known Exploited Vulnerabilities catalog and have been exploited in the wild since October–November 2025, with public proof-of-concept code and technical write-ups already available.
This context changes the posture. FortiWeb is an internet-facing security appliance that terminates inbound traffic in front of protected applications; an unauthenticated RCE hands an attacker a foothold on the very control point that inspects and proxies that traffic. The strategic concern the analyst raises — a low price point putting appliance-level RCE within reach of low-resource actors and initial-access brokers — is valid, but the more important point for our customers is that the underlying exploit already exists in public and is actively being used; this forum post is a resale of known capability, not a novel zero-day. For any organisation still running FortiWeb 8.0.0 or 8.0.1, the difference between a bluff and a functional chain is not what determines exposure — those builds are already exploitable with public tooling and should be patched to 8.0.2 or later immediately, and inspected for prior compromise.
Attack Surface
Web Application, Infrastructure
Tactics
Resource Development, Initial Access, Execution
Techniques
- T1588.005 – Obtain Capabilities: Exploits
- T1588.006 – Obtain Capabilities: Vulnerabilities
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1136.001 – Create Account: Local Account
SuperPRO's Threat Countermeasures Procedures
- Inventory all FortiWeb appliances running the 8.0 branch and move them off 8.0.0 and 8.0.1 to the latest available 8.0.x maintenance release, since those two builds are the versions named in the sale listing.
- Restrict FortiWeb administrative access to trusted management subnets only by editing the trusthost1 through trusthost10 fields under config system admin, and remove any 0.0.0.0/0 entries.
- Disable HTTPS and SSH administrative access on WAN facing interfaces using config system interface then set allowaccess to an empty or ping only value, so TCP/443, TCP/8443 and TCP/22 are not reachable from the internet.
- Audit the administrator list under System, Admin, Administrators for accounts not created by your team, and review config system admin output for unexpected profiles with prof_admin or super_admin privileges.
- Enable disk and remote event logging on FortiWeb and forward to SIEM, then alert on unauthenticated requests to /api/v2.0/ and /cgi-bin/ paths returning HTTP 200, and on any admin login event from a source outside your management range.
- Alert on outbound connections initiated by the FortiWeb management interface itself, particularly to non Fortinet destinations on TCP/4444, TCP/1337 or arbitrary high ports, which would be inconsistent with normal appliance behaviour.
- Subscribe to Fortinet PSIRT advisory notifications and cross reference any newly published FortiWeb 8.0 remote code execution or authentication bypass CVE against the version range 8.0 to 8.0.1 cited in this listing.
