Actively exploited in the wild
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet - FortiWeb · Listed in the CISA KEV since 2025-11-14. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-64446
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11 may allow an attacker to execute administrative commands via crafted HTTP or HTTPS requests.
Risk Assessment
An attacker can remotely execute administrative commands, potentially leading to full compromise of the FortiWeb system and the applications it protects.
Recommendation
Update FortiWeb to a patched version. Restrict access to management interfaces and monitor logs for suspicious requests.
Other vulnerabilities in Fortinet FortiWeb
See all- CVE-2016-4066High
CVE-2016-4066 is a CSRF vulnerability in Fortinet FortiWeb before version 5.5.3 that allows remote attackers to hijack the authentication of administrators for password change requests via unspecified vectors.
- CVE-2026-39811Medium
An integer overflow or wraparound vulnerability in Fortinet FortiWeb versions 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, 7.4, 7.2, and 7.0 may allow an attacker to cause a denial of service.
- CVE-2023-23783Medium
Fortinet FortiWeb versions 7.0.0 through 7.0.1 and FortiWeb 6.4 all versions contain a use of externally-controlled format string vulnerability allowing an attacker to execute unauthorized code or commands via specially crafted command arguments.
Original NVD description (English source)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS