Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability

Fortinet has warned that a FortiWeb vulnerability, CVE-2025-64446 (CVSS 9.1), allows remote, unauthenticated attackers to gain administrative access to FortiWeb appliances through a relative path traversal and authentication bypass. Fortinet says the flaw has been exploited in the wild, enabling attackers to create administrator accounts and fully compromise targeted devices.

The vulnerability affects FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11, with patches in 8.0.2, 7.6.5, 7.4.10, 7.2.12, and 7.0.12. On Friday, CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to address it within a week, under Binding Operational Directive 22-01, which requires federal agencies to patch within three weeks.

Security firms had already linked in-the-wild exploitation to FortiWeb 8.0.1 and earlier appliances, and WatchTowr highlighted global targeting of FortiWeb devices, with PoC code published by Defused. In response, Fortinet said it activated its PSIRT and remediation efforts and was advising affected customers to follow the FG-IR-25-910 advisory and disable HTTP/HTTPS for internet-facing interfaces until upgraded.