CVE-2025-64446: critical vulnerability in Fortinet FortiWeb
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 19/2025Vulnerabilidade crítica no FortiWeb da Fortinetread on gov.br ↗
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
FortiWeb has a path traversal flaw that lets attackers bypass security restrictions and run admin commands on the system by sending specially crafted web requests. This is critical because it gives attackers full control over the web application firewall.
A relative path traversal vulnerability (CWE-23) in affected FortiWeb versions allows unauthenticated or low-privileged attackers to manipulate file paths in HTTP/HTTPS requests to access restricted administrative functions and execute arbitrary commands with elevated privileges. The vulnerability affects versions 7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, and 8.0.0-8.0.1, with attack vector over the network requiring no user interaction.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.