U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Fortinet FortiWeb flaw CVE-2025-64446, with a CVSS score of 9.1, to its Known Exploited Vulnerabilities catalog. The vulnerability is a relative path traversal issue affecting FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11, enabling an attacker to execute administrative commands via crafted HTTP or HTTPS requests.

According to Fortinet’s advisory, “A relative path traversal vulnerability [CWE-23] in FortiWeb may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests,” and Fortinet has observed this to be exploited in the wild. CISA also advises disabling HTTP/HTTPS on internet-facing interfaces until upgrades are applied, with internal management access greatly reducing risk.

According to Binding Operational Directive (BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities), FCEB agencies must address the identified vulnerabilities by the due date to protect their networks, and CISA has ordered federal agencies to fix the vulnerabilities by 21 November 2025.