FortiWeb CVE-2025-25257 RCE Attempt

Aaron Mog@AaronMogS2S

•updated Aug 21, 2025•0•28

Detects potential Remote Code Execution (RCE) on a FortiWeb device, possibly related to CVE-2025-25257. The rule correlates a suspicious web request to a potential 'fabric' endpoint with a subsequent shell or utility process launch by the web server process on the same device.