CVE-2025-64446

FortiWeb is your web-facing security gateway. This bug lets an attacker use a weirdly crafted web request to “walk outside” the intended file paths and reach powerful administrative functions—without needing a login. In practical terms, that can mean an attacker gaining the ability to run system commands and take control of the appliance.

This matters if your business runs Fortinet FortiWeb (fortiweb) in the affected version ranges listed for CVE-2025-64446. The attack can be performed remotely over HTTP/HTTPS and does not require authentication, so exposure is the key question. Treat it as a risk when FortiWeb is reachable from untrusted networks (for example, the internet) via HTTP/HTTPS.

This is RED because real-world exploitation has been reported and CISA added this issue to its KEV list. Attackers can send remote HTTP/HTTPS requests without a login, which makes it especially dangerous for any internet-reachable FortiWeb deployment. Follow the fixed-version upgrades listed by Fortinet and meet the CISA remediation due date of 2025-11-21.

Confirm whether you’re affected

• Identify your Fortinet FortiWeb version (from the FortiWeb admin interface or system information screen).
• Compare to the affected ranges stated for CVE-2025-64446:
  • 8.0.0 through 8.0.1
  • 7.6.0 through 7.6.4
  • 7.4.0 through 7.4.9
  • 7.2.0 through 7.2.11
  • 7.0.0 through 7.0.11

Upgrade to the fixed version (primary remediation)

• Upgrade to one of the fixed versions:
  • 8.0.2 or above, or
  • 7.6.5 or above, or
  • 7.4.10 or above, or
  • 7.2.12 or above, or
  • 7.0.12
• Use Fortinet’s standard upgrade procedure for your model and current configuration (backup first, then apply the update, then verify services).

Workaround if you can’t upgrade immediately

• Prevent direct access from the public internet to FortiWeb’s HTTP/HTTPS management/web-facing endpoints.
• Follow Fortinet’s vendor mitigation instructions referenced in the FortiGuard PSIRT advisory for this issue, and apply any available compensating controls.

After patching: verify and monitor

• Review FortiWeb logs for suspicious or repeated HTTP/HTTPS requests consistent with traversal/probing activity.
• Look for indicators consistent with attempted administrative command execution (unexpected admin actions, unusual system behavior, or repeated error patterns around request handling).
• Validate that legitimate traffic and administrative functions still work as expected.

Timing

• CISA KEV remediation due date: 2025-11-21.

Severity is critical in practice because it involves remote, unauthenticated exploitation with high impact: administrative command execution. The weakness is a relative path traversal (CWE-23) that can be triggered via crafted HTTP/HTTPS requests to Fortinet FortiWeb, potentially reaching code paths that execute administrative commands on the system.

Exploitation status: CISA KEV lists this issue as actively exploited, and reporting indicates attackers are using authentication bypass/impersonation behavior in conjunction with the vulnerability; packet captures and active exploitation in the wild have been reported.

Exploit maturity: public proof-of-concept exists, lowering barriers for attackers. The CVE is also listed in the KEV catalog and has a CISA remediation due date of 2025-11-21.

Note: while EPSS predicted high likelihood, this public guidance prioritizes the KEV and “exploited in the wild” findings over predictions.