Actively exploited in the wild
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet - FortiWeb · Listed in the CISA KEV since 2025-11-14. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-64446
CriticalCVSS 9.8KEVSummary
A relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11 may allow an attacker to execute administrative commands via crafted HTTP or HTTPS requests.
Risk Assessment
An attacker can remotely execute administrative commands, potentially leading to full compromise of the FortiWeb system and the applications it protects.
Recommendation
Update FortiWeb to a patched version. Restrict access to management interfaces and monitor logs for suspicious requests.
Other vulnerabilities in Fortinet FortiWeb
Original NVD description (English source)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.