CVE-2025-64447
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 rely on cookies without validation and integrity checking. An unauthenticated attacker may execute arbitrary operations on the system via crafted HTTP or HTTPS requests using forged cookies, requiring prior knowledge of the FortiWeb serial number.
Risk Assessment
An unauthenticated attacker who knows the device serial number can execute arbitrary operations on the system, potentially leading to full compromise of FortiWeb. This poses a serious threat to the security of the network protected by the device.
Recommendation
Upgrade FortiWeb to the latest patched version. Restrict access to the management interface and protect the device serial number from disclosure.
Other vulnerabilities in FortiWeb
See all- CVE-2026-26035Critical
An Improper Authentication vulnerability (CWE-287) in Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password.
- CVE-2026-40688High
An out-of-bounds write vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11 allows a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.
- CVE-2025-58034HighActively exploited
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
- CVE-2026-70466Medium
Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.5, 7.4 (all), 7.2 (all), and 7.0 (all) have an incomplete list of disallowed inputs vulnerability, which may allow an attacker to cause improper access control.
- CVE-2025-64471Medium
A use of password hash instead of password for authentication vulnerability [CWE-836] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests.
Original NVD description (English source)
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS