Critical Fortinet FortiWeb WAF Bug Exploited in the Wild

A critical Fortinet FortiWeb vulnerability capable of remote code execution has been exploited in the wild, affecting FortiWeb versions ranging from 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.11.

Fortinet disclosed CVE-2025-64446 on 14 November, describing the flaw as a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests; the vulnerability is rated critical with a CVSS score of 9.1.

According to Fortinet's PSIRT advisory, the issue can be triggered in a pre-authentication state on a vulnerable FortiWeb instance, enabling attackers to create new accounts, modify configurations, or execute other privileged API commands. The vulnerability has been added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog, underscoring its active exploitation.

Fortinet also notes that remediation involves upgrading to patched versions (for example 8.0.2 and above, 7.6.5 and above, 7.4.10 and above, 7.2.12 and above, or 7.0.12 and above) or, if upgrading is not feasible, disabling HTTP or HTTPS for Internet-facing interfaces as a temporary mitigation.