CVE-2025-64446: Fortinet FortiWeb path traversal authentication bypass, actively exploited
The short version: Fortinet FortiWeb — the web application firewall — has a relative path-traversal flaw (CVE-2025-64446) that lets an attacker bypass authentication and execute administrative commands, including standing up rogue admin accounts. It scores 9.8, it's in CISA's KEV catalog, and it's been actively exploited since early October 2025. Patch and check for rogue admins. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (Fortinet CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD analysis pending at time of writing) |
| EPSS | ~89% · 99.77th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2025-11-14; remediation was due 2025-11-21 |
| Known exploited? | Yes — actively exploited since early October 2025 to create unauthorized admin accounts |
| Vulnerability type | CWE-23 relative path traversal → authentication bypass → administrative command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | FortiWeb 7.0.0–7.0.11, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.4, 8.0.0–8.0.1 |
| Fixed in | FortiWeb 7.0.12 · 7.2.12 · 7.4.10 · 7.6.5 · 8.0.2 and later |
What you need to know
CVE-2025-64446 is a relative path-traversal flaw in FortiWeb. By crafting an HTTP/HTTPS request that walks the path back into a privileged CGI endpoint, an attacker bypasses authentication and reaches administrative functionality — no credentials required.
- How they find it — internet-wide scanning surfaces exposed FortiWeb management and login interfaces.
- How they use it — a single crafted request bypasses auth; in observed activity, attackers used it to create unauthorized administrator accounts. Public proof-of-concept detail followed quickly.
- What it leads to — administrative control of the WAF, which sits in front of your web applications and can be turned from a defense into a pivot.
How serious we see it
Critical — the score matches the field reports.
Pre-authentication administrative access on an internet-facing security appliance, confirmed exploited to plant rogue admins, is top-of-queue. The bounded, reassuring part: it affects specific FortiWeb branches, the fixes are published across all of them, and exposure is quick to determine. The catch is that exploitation predates the advisory — so check for rogue accounts and config changes, because a patched FortiWeb isn't automatically a clean one.
Recommendations
Straight from Fortinet's advisory (FG-IR-25-910) and CISA:
- Patch now. Upgrade to FortiWeb 7.0.12 / 7.2.12 / 7.4.10 / 7.6.5 / 8.0.2 or later.
- Hunt for rogue admins. Review administrator accounts, config changes, and logs for unexpected additions made during the exposure window.
- If you find indicators, respond fully. Remove rogue accounts, rebuild if warranted, and rotate credentials, keys, and certificates.
- Harden exposure. Get the FortiWeb management interface off the public internet; restrict it to trusted networks.
- Confirm your exposure first. Verify whether any FortiWeb interface is internet-facing and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing FortiWeb login and management interfaces from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check against the affected endpoint to confirm the traversal responds, rather than flagging a maybe.
That outside-in, continuous view is the whole point when a WAF bypass is being used to plant admins: the exposed appliance is already mapped and ranked, so you go straight to patch-and-verify.