CVE-2025-64446 kev in the critical feed json
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.…
published 2025-11-14 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-197613
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2025-11-14
- epss
- 91.1%
- EPSS 91.1% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 4
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Patch / fix
cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- fortinet fortiweb 7.0.12, 7.2.12, 7.4.10, 7.6.5, 8.0.2
Timeline
- First public exploit (Metasploit auxiliary/admin/http/fortinet_fortiweb_create_admin)
- Added to CISA KEV
- Published
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 11 mo ago
- Patch by
- 2025-11-21 (11 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Fortinet, FortiWeb
- CISA name
- Fortinet FortiWeb Path Traversal Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 11 mo ago
Exploit prediction
91.08% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/admin/http/fortinet_fortiweb_create_admin Fortinet FortiWeb create new local admin metasploit auxiliary, normal rank, 2025-11-14
- Metasploit exploit/linux/http/fortinet_fortiweb_rce Fortinet FortiWeb unauthenticated RCE metasploit exploit, excellent rank, 2025-11-14
- EDB-52502 FortiWeb 8.0.2 - Remote Code Execution webapps, 2026-04-08
- EDB-52495 Fortinet FortiWeb v8.0.1 - Auth Bypass webapps, 2026-04-06
- Nuclei template FortiWeb - Authentication Bypass nuclei detection template
- github.com https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Fortinet FortiWeb
Classification
- Weakness
-
- CWE-23 Relative Path Traversal
- Technology feeds
References
-
github.com
/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass
exploit, third-party-advisory
-
fortiguard.fortinet.com
/psirt/FG-IR-25-910
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446
government-resource, us-government-resource
Sources
- CVE List CVE-2025-64446
- NVD CVE-2025-64446
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.