CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability
Description
CVE-2025-64446 is a critical relative path traversal vulnerability in Fortinet FortiWeb that enables unauthenticated attackers to execute administrative commands on the system. Affecting FortiWeb versions from 7.0.0 through 8.0.1, the vulnerability allows exploitation via crafted HTTP or HTTPS requests without any authentication. With a CVSS v3.1 base score of 9.8, this represents a worst-case scenario for a security appliance, granting attackers full control over the web application firewall. CISA has added CVE-2025-64446 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 21, 2025, and the EPSS score of 89.02% at the 99.5th percentile confirms near-certain exploitation, placing it among the most dangerous network security appliance vulnerabilities currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiweb | >= 7.0.0, < 7.0.12; >= 7.2.0, < 7.2.12; >= 7.4.0, < 7.4.10; >= 7.6.0, < 7.6.5; >= 8.0.0, < 8.0.2 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-910(Vendor Advisory)
- https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446(US Government Resource)
Weakness Type
CWE-23: Relative Path Traversal
CVE-2025-64446 is classified under CWE-23 (Relative Path Traversal), a vulnerability class where an application uses user-supplied input to construct a file path without adequately neutralizing sequences like "../" that can resolve to locations outside the intended directory. In FortiWeb, the path traversal vulnerability allows attackers to access administrative functionality by manipulating path components in HTTP or HTTPS requests. The traversal bypasses authentication and authorization controls by accessing administrative endpoints through path manipulation rather than through the normal authenticated access path. This effectively turns a directory traversal into an authentication bypass, enabling unauthenticated users to invoke administrative commands. Learn more about CWE-23
Impact Analysis
CVE-2025-64446 represents a catastrophic compromise of enterprise web application security infrastructure. Confidentiality is fully compromised because unauthenticated administrative access to FortiWeb exposes all WAF configurations, security policies, SSL/TLS certificates with private keys, protected application traffic, backend server configurations, and the internal network architecture visible from the WAF's deployment position. For organizations relying on FortiWeb to protect sensitive web applications, this exposure extends to all data flowing through the compromised appliance.
Integrity faces maximum impact as administrative command execution enables the attacker to modify all security policies, disable web application protections, inject malicious content into proxied traffic, create persistent backdoor accounts, and reconfigure the device to serve as an attack platform against protected backend applications. A silently compromised WAF that continues to pass traffic while no longer enforcing security rules is among the most dangerous scenarios in enterprise security.
Availability is critically threatened since the attacker can disable the FortiWeb service, corrupt configurations, or deploy destructive payloads on the underlying system. The EPSS score of 89.02% at the 99.5th percentile places this in the top 0.5% of all vulnerabilities for exploitation probability, indicating widespread and aggressive exploitation campaigns. Public exploit code is available at watchTowr Labs GitHub repository, further lowering the barrier to exploitation. While the ransomware association is classified as unknown, the pre-authentication nature and critical severity make this an exceptionally attractive target for all threat actor categories.
Exploit Maturity
CVE-2025-64446 has reached maximum exploit maturity. The EPSS score of 89.02% at the 99.5th percentile places it in the top 0.5% of all tracked vulnerabilities, indicating that exploitation is occurring at massive scale. CISA has confirmed active exploitation through KEV catalog inclusion.
Public exploit code is available from watchTowr Labs at their GitHub repository, providing a complete authentication bypass proof-of-concept that enables anyone to reproduce the attack. Fortinet has published an official advisory at FG-IR-25-910. The combination of pre-authentication exploitation (PR:N), no user interaction required (UI:N), publicly available exploit code, and critical impact makes this one of the most dangerous security appliance vulnerabilities in the current threat landscape. The ransomware association is classified as unknown, but the pre-authentication administrative access this vulnerability provides is the exact type of initial access capability that ransomware affiliates and nation-state actors actively seek. Organizations that have not patched vulnerable FortiWeb instances exposed to the internet should assume compromise.
Remediation
-
Upgrade FortiWeb urgently to the patched version for your deployment branch: 7.0.12+ for 7.0.x, 7.2.12+ for 7.2.x, 7.4.10+ for 7.4.x, 7.6.5+ for 7.6.x, or 8.0.2+ for 8.0.x. Refer to the Fortinet advisory FG-IR-25-910 for specific version guidance. This should be treated as the highest priority security action given the pre-authentication nature and public exploit availability.
-
Assume compromise for any FortiWeb instance that was running a vulnerable version while accessible from untrusted networks. Conduct a full forensic investigation including review of administrative accounts, configuration integrity, SSL certificate exposure, security policy modifications, and system-level indicators of compromise such as unauthorized files, processes, or network connections.
-
Isolate FortiWeb management interfaces from all untrusted network access immediately. While the data-plane traffic must continue flowing, the management interface should be restricted to dedicated management VLANs with strict access controls. If the vulnerability was exploited through the data plane, consider implementing upstream network filtering to block the specific path traversal patterns.
-
Rotate all sensitive material stored on or passing through compromised FortiWeb instances. This includes SSL/TLS certificates and private keys for all protected applications, administrator credentials, API keys, and any secrets configured on the device. Notify certificate authorities if private key compromise is suspected.
-
Review downstream application security for any protected web applications that may have been exposed while the FortiWeb protections were potentially bypassed or modified. Check backend application logs for evidence of attacks that would normally be blocked by the WAF, and conduct security assessments on applications that relied solely on FortiWeb for protection.
Technical Details
CVE-2025-64446 is a relative path traversal vulnerability in Fortinet FortiWeb. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, producing a base score of 9.8.
The vector reveals the maximum severity achievable for an unchanged-scope vulnerability. Attack Vector (AV:N) confirms remote exploitation over HTTP or HTTPS. Attack Complexity (AC:L) indicates reliable, straightforward exploitation. Privileges Required (PR:N) is the most critical element, confirming that no authentication is required to exploit the vulnerability. User Interaction (UI:N) means the attack is fully automated. Scope (S:U) indicates impact is assessed within the FortiWeb boundary, though practical impact extends to all protected applications.
The vulnerability allows unauthenticated attackers to execute administrative commands by exploiting path traversal in HTTP/HTTPS request handling. FortiWeb processes incoming requests and routes them based on URL paths. The path traversal vulnerability allows an attacker to craft requests with relative path components (such as "../") that navigate from unauthenticated URL paths to administrative command execution endpoints. This effectively bypasses the authentication layer that normally protects administrative functions. The watchTowr Labs exploit demonstrates this authentication bypass technique. Once administrative command execution is achieved, the attacker has full control over the FortiWeb appliance, including the ability to modify configurations, access encrypted traffic, and execute operating system commands. Affected versions include FortiWeb 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1.
Frequently Asked Questions
What is CVE-2025-64446?
CVE-2025-64446 is a critical relative path traversal vulnerability in Fortinet FortiWeb that allows unauthenticated remote attackers to execute administrative commands on the web application firewall. No credentials or user interaction are required for exploitation.
Is public exploit code available?
Yes. watchTowr Labs has published a complete proof-of-concept exploit at their GitHub repository demonstrating the authentication bypass technique. This significantly increases the risk of widespread exploitation.
Which FortiWeb versions are affected?
FortiWeb 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1 are vulnerable. Patched versions are 7.0.12, 7.2.12, 7.4.10, 7.6.5, and 8.0.2 respectively.
Should I assume my FortiWeb has been compromised?
If your FortiWeb was running a vulnerable version while accessible from untrusted networks, and given the EPSS score of 89.02% and publicly available exploit code, you should treat it as potentially compromised and conduct a thorough forensic investigation alongside upgrading to a patched version.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.