CVE-2025-64446: Critical Fortinet FortiWeb Vulnerability
In mid-November 2025, a critical vulnerability in Fortinet FortiWeb (CVE-2025-64446, CVSS 9.1) was reported under active exploitation. The issue is a relative path traversal that can allow an unauthenticated attacker to execute administrative commands via crafted HTTP or HTTPS requests.
Impact and response
Successful exploitation can result in unauthorized administrative access, including the creation of new administrator accounts. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Fortinet released a patched version (reported as 8.0.2 in late October), though some researchers noted a delay between the silent patch and public guidance.
Recommendations
- Upgrade FortiWeb appliances to a fixed version immediately.
- If an immediate upgrade is not possible, disable HTTP/HTTPS on internet-facing interfaces where feasible.
- Inspect logs for unauthorized administrator account creation or unusual administrative activity.
- Treat any internet-exposed FortiWeb instance that was unpatched during the exploitation window as potentially compromised until verified.
This post is for awareness only and does not include exploit details.