Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2025-64446

Published 2025-11-14

Updated 3 months ago

Vendor/s

Fortinet

Product/s

FortiWeb

Version/s

7.0.0 > 7.0.12

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

Critical path traversal vulnerability in Fortinet FortiWeb (CVSS 9.8) allows unauthenticated remote administrative command execution. Actively exploited.

## Why this matters

CVE-2025-64446 is a critical vulnerability with a CVSS score of 9.8 that allows unauthenticated attackers to execute administrative commands on Fortinet FortiWeb appliances. This flaw is particularly dangerous because it is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Since FortiWeb is a Web Application Firewall (WAF) designed to protect other assets, a compromise here grants attackers a foothold at a strategic network junction. The vulnerability requires no user interaction and can be triggered remotely via crafted HTTP or HTTPS requests, making immediate remediation essential for any organization using affected versions.

## CPE

Fortinet

| Product  | Version Start | Version End (excl.) | Status     |
| -------- | ------------- | ------------------- | ---------- |
| fortiweb | 7.0.0         | 7.0.12              | vulnerable |
| fortiweb | 7.2.0         | 7.2.12              | vulnerable |
| fortiweb | 7.4.0         | 7.4.10              | vulnerable |
| fortiweb | 7.6.0         | 7.6.5               | vulnerable |
| fortiweb | 8.0.0         | 8.0.2               | vulnerable |

## Related weakness (CWE)

CWE-23

## Remediation plan

1

### Apply official patches

Immediately update Fortinet FortiWeb to the latest secure firmware versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, or 7.0.12) following the guidance in FortiGuard advisory FG-IR-25-910.

2

### Update affected systems

Identify and upgrade all instances running vulnerable versions, including FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11.

3

### Restrict access

Minimize the attack surface by restricting access to the FortiWeb management interface. Use firewall policies to ensure administrative ports are only accessible from trusted internal IP addresses or via a secure VPN.

4

### Monitor for exploitation

Audit system logs for unauthorized administrative command execution and review web traffic for suspicious path traversal patterns, such as '../' sequences, in incoming HTTP/HTTPS requests.

## Detection Guidance

To detect potential exploitation of CVE-2025-64446, security teams should scan web server logs for HTTP/HTTPS requests containing relative path traversal sequences (e.g., '../' or its URL-encoded variants) directed at management endpoints. Monitor for anomalous administrative activity, such as the creation of new accounts or unexpected configuration changes. Additionally, look for indicators of shell command execution originating from the FortiWeb process and implement IDS/IPS signatures specifically tuned for Fortinet path traversal vulnerabilities.

## References

[https://fortiguard.fortinet.com/psirt/FG-IR-25-910 Vendor Advisory ](https://fortiguard.fortinet.com/psirt/FG-IR-25-910)[https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass Exploit Third Party Advisory ](https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2025-64446 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)