CVE-2025-64446 (CVSS Pending): Actively Exploited Fortinet FortiWeb Path Traversal Vulnerability

Estimated reading time: 7 minutes

  • CVE-2025-64446 is a critical path traversal vulnerability in Fortinet FortiWeb.
  • Successful exploitation allows unauthenticated attackers to execute administrative commands.
  • Affected versions include FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11.
  • Immediate mitigation steps include upgrading to a fixed version, disabling HTTP/HTTPS access, and monitoring for suspicious activity.
  • PurpleOps provides services to help organizations mitigate this and other vulnerabilities.

Table of Contents:

Understanding CVE-2025-64446: FortiWeb Path Traversal

CVE-2025-64446 is a relative path traversal vulnerability (CWE-23) affecting Fortinet FortiWeb web application firewalls. This vulnerability allows an unauthenticated attacker to execute administrative commands on a compromised system by sending specially crafted HTTP or HTTPS requests. The vulnerability stems from insufficient validation of user-supplied input, enabling attackers to manipulate file paths and access unauthorized resources.

The active exploitation of this vulnerability underscores the critical need for organizations to promptly address security flaws in their web-facing applications. The cyber threat intelligence platform should be updated.

Scope and Impact

Successful exploitation of CVE-2025-64446 can have severe consequences, including:

  • Unauthorized Access: Attackers can gain administrative privileges, allowing them to control the FortiWeb appliance and potentially the protected web applications.
  • Data Breach: With administrative access, attackers can access sensitive data stored within or accessible through the web applications.
  • System Compromise: The attacker may install malware, create backdoors, or pivot to other systems on the network.
  • Denial of Service: Attackers may disrupt the availability of the FortiWeb appliance and the protected web applications.
  • Persistence: Attackers are reportedly using the vulnerability to create new administrator accounts as a basic persistence mechanism. This allows them to regain access to the system even after the initial vulnerability is patched if the rogue accounts are not removed.

The exploitation of this vulnerability highlights the importance of breach detection and incident response capabilities.

Affected Versions

The vulnerability affects the following versions of FortiWeb:

  • 8.0.0 through 8.0.1
  • 7.6.0 through 7.6.4
  • 7.4.0 through 7.4.9
  • 7.2.0 through 7.2.11
  • 7.0.0 through 7.0.11

Organizations using these versions of FortiWeb are at high risk and should take immediate action.

Timeline of Discovery and Response

  • Early November 2025: Security researchers at watchTowr observed active exploitation of a silently patched vulnerability in Fortinet’s FortiWeb product.
  • November 6, 2025: Rapid7 Labs observed an alleged zero-day exploit targeting FortiWeb being offered for sale on a black hat forum. While it is not confirmed to be the same exploit, the timing is noteworthy.
  • Mid-November 2025: Fortinet acknowledged the vulnerability and its active exploitation.
  • November 15, 2025: CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities Catalog and shared Fortinet’s advisory.

This timeline highlights the importance of real-time ransomware intelligence and proactive vulnerability management.

Mitigation Strategies

Fortinet and CISA strongly recommend the following mitigation strategies:

  1. Immediate Upgrade: Upgrade to a fixed version of FortiWeb as soon as possible. This is the only way to fully remediate the vulnerability.
  2. Disable HTTP/HTTPS Access: If upgrading is not immediately feasible, disable HTTP or HTTPS access for internet-facing interfaces. Note that this measure only reduces the risk but does not eliminate it entirely. Upgrading the affected systems remains essential.
  3. Monitor for Suspicious Activity: Implement robust monitoring and logging to detect any signs of exploitation attempts. Look for unusual HTTP requests, unauthorized access attempts, and the creation of new administrator accounts.
  4. Review Existing Accounts: Audit existing FortiWeb administrator accounts to identify and remove any unauthorized or suspicious accounts created by attackers. This is crucial to prevent persistent access even after patching.
  5. Web Application Firewall (WAF) Rules: Deploy or update WAF rules to filter out malicious requests that attempt to exploit the path traversal vulnerability. This can provide an additional layer of protection while waiting for a permanent patch.
  6. Incident Response Plan: Ensure a well-defined incident response plan is in place to handle potential security breaches. This plan should include procedures for identifying, containing, eradicating, and recovering from an attack.

Organizations should prioritize upgrading their FortiWeb installations to a patched version. If immediate patching is not possible, disabling HTTP/HTTPS access and implementing WAF rules can help mitigate the risk. Continuous monitoring and review of administrator accounts are essential for detecting and preventing persistent access. The implementation of a cyber threat intelligence platform is critical.

Practical Takeaways

Technical Readers:

  • Patch Immediately: Prioritize patching FortiWeb installations to the latest stable version.
  • Inspect Web Traffic: Analyze web traffic logs for suspicious patterns indicative of path traversal attempts.
  • Implement WAF Rules: Create or update WAF rules to block known exploitation attempts.
  • Automate Vulnerability Scanning: Implement automated vulnerability scanning to identify and address security flaws promptly.

Non-Technical Readers:

  • Communicate Urgency: Ensure that technical teams understand the severity of the vulnerability and the need for immediate action.
  • Allocate Resources: Provide the necessary resources and support to enable timely patching and mitigation efforts.
  • Verify Security Posture: Request regular reports on the organization’s security posture, including vulnerability management and incident response capabilities.
  • Ensure Backups: Verify that configurations are backed up before any changes are made, so that they can be quickly reverted if there are any issues.

PurpleOps and Vulnerability Mitigation

PurpleOps provides a suite of services that can assist organizations in mitigating vulnerabilities like CVE-2025-64446, including:

  • Cyber Threat Intelligence: PurpleOps offers a cyber threat intelligence platform that provides organizations with up-to-date information on emerging threats and vulnerabilities, including real-time ransomware intelligence. This enables proactive identification and mitigation of potential risks.
  • Breach Detection and Response: PurpleOps’ breach detection services help organizations identify and respond to security incidents quickly and effectively, minimizing the impact of a successful attack.
  • Vulnerability Management: PurpleOps offers vulnerability scanning and assessment services to identify and prioritize vulnerabilities in an organization’s IT infrastructure.
  • Penetration Testing: PurpleOps provides services to simulate real-world attacks and identify weaknesses in an organization’s security posture.
  • Supply Chain Risk Monitoring: PurpleOps offers supply-chain risk monitoring services to help organizations assess and manage the security risks associated with their third-party vendors.
  • Dark Web Monitoring: PurpleOps’ dark web monitoring service can detect compromised credentials and other sensitive information that may be used to exploit vulnerabilities.
  • Brand Leak Alerting: PurpleOps provides brand leak alerting services to notify organizations of any unauthorized use of their brand or sensitive information online, including on the dark web.
  • Underground Forum Intelligence: PurpleOps monitors underground forum intelligence to identify discussions about exploits and vulnerabilities that could target an organization’s systems.

By leveraging PurpleOps’ expertise and services, organizations can strengthen their security posture and reduce their risk of falling victim to cyberattacks.

For more information on how PurpleOps can help your organization protect against cyber threats, explore our platform or contact us at PurpleOps Solutions. You can also learn about our red team operations at red team operations and our penetration testing services at . Explore our supply chain information security solutions at supply chain information security and our ransomware protection services at ransomware protection. Learn more about our dark web monitoring at dark web monitoring and our cyber threat intelligence at cyber threat intelligence.

FAQ

Q: What is CVE-2025-64446?
A: CVE-2025-64446 is a path traversal vulnerability in Fortinet FortiWeb that allows unauthenticated attackers to execute administrative commands.

Q: Which FortiWeb versions are affected?
A: Affected versions include 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11.

Q: What are the recommended mitigation steps?
A: Upgrade to a fixed version, disable HTTP/HTTPS access, monitor for suspicious activity, and review existing accounts.

Q: How can PurpleOps help mitigate this vulnerability?
A: PurpleOps offers cyber threat intelligence, breach detection, vulnerability management, and other services to strengthen your security posture.