CVE-2025-64446
Published: 14 November 2025
Summary
CVE-2025-64446 is a critical-severity Relative Path Traversal (CWE-23) vulnerability in Fortinet Fortiweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and correction of system flaws such as this relative path traversal vulnerability through timely application of Fortinet patches.
Mandates receiving and implementing security alerts and advisories from Fortinet PSIRT and CISA KEV cataloging this actively exploited vulnerability.
Implements input validation on HTTP/HTTPS requests to block or sanitize relative path traversal sequences targeting the vulnerable FortiWeb handler.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Relative path traversal enables unauthenticated execution of administrative commands on FortiWeb (network appliance), facilitating public-facing application exploitation for initial access (T1190), network device CLI command execution (T1059.008), and local account creation as demonstrated in the PoC (T1136.001).
NVD Description
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted…
more
HTTP or HTTPS requests.
Deeper analysisAI
CVE-2025-64446 is a relative path traversal vulnerability (CWE-23) affecting Fortinet FortiWeb web application firewalls in multiple versions, specifically 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. It enables attackers to execute administrative commands on the system by sending crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility (AV:N), low attack complexity (AC:L), lack of required privileges or user interaction (PR:N/UI:N), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
An unauthenticated attacker can exploit this vulnerability remotely over the network with minimal complexity, requiring no privileges or user interaction. Successful exploitation grants the ability to execute arbitrary administrative commands, potentially leading to full system compromise, including data exfiltration, modification, or disruption of the FortiWeb appliance.
Fortinet's PSIRT advisory (FG-IR-25-910) provides details on the issue and likely mitigation steps, such as applying patches for affected versions. Additional technical analysis appears in a GitHub repository from WatchTowr Labs focused on FortiWeb authentication bypass techniques.
This vulnerability is cataloged in CISA's Known Exploited Vulnerabilities list, indicating active real-world exploitation. Security practitioners should prioritize patching affected FortiWeb instances.
Details
- CWE(s)
- KEV Date Added
- 14 November 2025