CVE-2025-64446

Source: THN — https://t.co/Tco6v97sOv Group-IB / NyxLab joint investigation (cited in THN) CVEs: CVE-2025-64446, CVE-2026-0257

Your "secure perimeter" just became k0t's warehouse. Group-IB + NyxLab: 70,000+ credentials from exposed Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect — CVE-2025-64446 + CVE-2026-0257 — then pushed toward ransomware (Qilin / The Gentlemen). If that box still has a public management IP, th…

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs Group-IB and NyxLab expose a year-long global campaign by initial access broker k0t, compromising Fortinet and Palo Alto firewalls to feed Qilin and The Gentlemen ransomware. ⏱️ 366-day operational windo…

Group-IB and NyxLab tracked an actor called k0t hitting exposed FortiGate, FortiWeb and GlobalProtect boxes via CVE-2025-64446, CVE-2026-0257 and brute force. 70K+ creds exposed. Many victims later showed up on Qilin and The Gentlemen leak sites. #ransomware #ThreatIntel https://t.co/0Ju7xGtrm9

Massive breach alert: 70,000+ credentials exposed as threat actor k0t exploits Fortinet and Palo Alto firewall & VPN flaws. The incident shows CVE-2025-64446 and CVE-2026-0257 being weaponized at scale—credential theft, LDAP dumps, and persistence via remote-access tools. Edge devices, global footp…

the fortigate side of the k0t edge campaign was password guessing on the REST API, not a CVE. the CVEs were for fortiweb (CVE-2025-64446) and globalprotect (CVE-2026-0257) after getting in they pulled the fortigate config and decrypted its secrets offline with the default fortios AES key, the 2019…

70,000 firewall credentials in one dataset. Group-IB: k0t exploits FortiWeb CVE-2025-64446, brute forces FortiGate, then decrypts configs with Fortinet's default AES key. Close admin access. Enable private-data-encryption. #CyberSecurity #Fortinet

@DailyDarkWeb The forum post says "1-day exploit for Fortinet Fortiweb", apparently on versions 8.0 and 8.1 chaining 2 CVEs. This could be linked to CVE-2025-64446 + CVE-2025-58034 chaining. Why does your text mentions "Fortinet Fortigate SSL VPN" and "7.2.x and 7.4.x" ?

CerberusMrXi/FortiWeb-cve-2025-64446-RCE-exploit: Security research tool for FortiWeb CVE-2025-64446 vulnerability. Automated exploitation framework with advanced logging, real-time metrics, proxy debugging, and professional reporting. Includes retry logic, multi-threading, and configurable setting…

GitHub cross-source: verylazytech/CVE-2025-64446: CVE-2025-64446 - A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to exec…

GitHub cross-source: sensepost/CVE-2025-64446: A scanner for the FortiNet vulnerability CVE-2025-64446

GitHub cross-source: soltanali0/CVE-2025-64446-Exploit:

GitHub cross-source: sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC:

GitHub cross-source: fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal: PoC de CVE-2025-64446: path traversal a RCE en Fortinet FortiWeb. Solo uso educativo.