CVE-2025-64446

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-11-14
• Remediation due date: 2025-11-21
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-23

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-910
• https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446

More from Fortinet

• CVE-2025-61624 — Multiple Products
• CVE-2026-104286 — FortiMail
• CVE-2025-25249 — Multiple Products
• CVE-2025-68686 — FortiOS
• CVE-2026-39808 — FortiSandbox