Hard-coded credentials in Fortinet FortiWeb Redis service

Successful exploitation allows an attacker with authenticated shell access on the FortiWeb appliance to authenticate to the internal Redis service and access its data. This can expose sensitive application or operational data stored in Redis and may facilitate further post-exploitation activity depending on what information is present in that datastore. Based on the provided information, the confirmed impact is unauthorized access to Redis data.

If immediate patching is not possible, restrict shell access to the FortiWeb device to only highly trusted administrators, minimize the number of accounts capable of obtaining shell access, and tightly control administrative pathways to the appliance. Limit access to the internal Redis service through host-based and network segmentation controls where feasible, monitor for unexpected Redis connections or access patterns on the appliance, and review appliance access logs for signs of post-authentication abuse. These are compensating controls only; patching is the primary mitigation.

Apply Fortinet updates that remediate CVE-2025-59669 in affected FortiWeb releases. The provided content states that Fortinet has released patches and recommends immediate updates to affected systems. Upgrade from affected versions of FortiWeb 7.6.0, 7.4.x, 7.2.x, and 7.0.x to vendor-fixed releases as identified by Fortinet.