{"id":"CVE-2025-64446","published":"2025-11-14T16:15:58Z","modified":"2026-10-18T20:10:00Z","title":"Fortinet FortiWeb Path Traversal Vulnerability","vendor":"Fortinet","product":"FortiWeb","tier":"core","eol":null,"description":{"text":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","provenance":"source","from":"NVD"},"summary":{"text":"A relative path traversal flaw in Fortinet FortiWeb (versions 7.0.0 through 8.0.1, across the 7.0, 7.2, 7.4, 7.6 and 8.0 branches) allows an attacker to bypass path restrictions and reach system functionality. An unauthenticated remote attacker over the network, requiring no user interaction and no special configuration, can execute administrative commands on the device by sending crafted HTTP or HTTPS requests.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:08:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91078,"percentile":0.99807,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-11-14","dueDate":"2025-11-21","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortiguard.com/psirt/FG-IR-25-910 ; https://nvd.nist.gov/vuln/detail/CVE-2025-64446","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-10-06","exploitedFirstSeen":"2025-10-06","ransomware":true,"evidence":[{"url":"https://x.com/DefusedCyber/status/1975242250373517373","date":"2025-10-06"},{"url":"https://www.pwndefend.com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/","date":"2025-11-13"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-64446","date":"2025-11-14"},{"url":"https://arcticwolf.com/resources/blog/cve-2025-64446/","date":"2025-11-14"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/11/14/unauthenticated-authentication-bypass-in-fortinet-fortiweb-cve-2025-64446-exploited-in-the-wild","date":"2025-11-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-11-14"},{"url":"https://www.fortiguard.com/psirt/FG-IR-25-910","date":"2025-11-14"},{"url":"https://x.com/CERTCyberdef/status/1989311517611733454","date":"2025-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-15&host_type=src&vulnerability=cve-2025-64446","date":"2025-11-15"},{"url":"https://isc.sans.edu/diary/rss/32486","date":"2025-11-15"}],"evidenceTotal":224,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6ae254cc040814cb0f04c713","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6adba62cf47b44713c9e594b","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords","url":"https://otx.alienvault.com/pulse/6ad9b39f83888afc0f038431","created":"2026-10-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-910","tags":["Vendor Advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network request exploits public-facing web app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"via crafted HTTP or HTTPS requests","start":274,"end":308}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker executes administrative commands on system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may allow an attacker to execute administrative commands on the system","start":203,"end":273}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-197613","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197613","exploited":true,"exploitedSince":"2025-11-14","provenance":"source"},"exploits":[{"id":52495,"url":"https://www.exploit-db.com/exploits/52495","title":"Fortinet FortiWeb v8.0.1 - Auth Bypass","type":"webapps","platform":"multiple","date":"2026-04-06","verified":false,"provenance":"source"},{"id":52502,"url":"https://www.exploit-db.com/exploits/52502","title":"FortiWeb  8.0.2 - Remote Code Execution","type":"webapps","platform":"multiple","date":"2026-04-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2026-04-06"},"pocGithub":{"count":12,"skipped":1,"earliest":"2025-11-14","earliestUrl":"https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","repos":[{"name":"sensepost/CVE-2025-64446","url":"https://github.com/sensepost/CVE-2025-64446","stars":34,"created":"2025-11-17"},{"name":"soltanali0/CVE-2025-64446-Exploit","url":"https://github.com/soltanali0/CVE-2025-64446-Exploit","stars":15,"created":"2025-11-15"},{"name":"sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC","url":"https://github.com/sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC","stars":14,"created":"2025-11-14"},{"name":"fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","url":"https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","stars":7,"created":"2025-11-14"},{"name":"verylazytech/CVE-2025-64446","url":"https://github.com/verylazytech/CVE-2025-64446","stars":3,"created":"2025-11-17"}]},"metasploit":[{"name":"Fortinet FortiWeb create new local admin","module":"auxiliary/admin/http/fortinet_fortiweb_create_admin","type":"auxiliary","disclosureDate":"2025-11-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb"},{"name":"Fortinet FortiWeb unauthenticated RCE","module":"exploit/linux/http/fortinet_fortiweb_rce","type":"exploit","disclosureDate":"2025-11-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_fortiweb_rce.rb"}],"nuclei":[{"id":"CVE-2025-64446","name":"FortiWeb - Authentication Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-64446.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64446.yaml"}],"first":{"date":"2025-11-14","source":"PoC-in-GitHub","url":"https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal"},"provenance":"source"},"exploitRefs":["https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-10-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/DefusedCyber/status/1975242250373517373","provenance":"source"},{"date":"2025-11-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64446","provenance":"source"},{"date":"2025-11-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2025-11-14, Exploit-DB 2026-04-06","url":"https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","provenance":"source"},{"date":"2025-11-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-11-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197613","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 389 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 12 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-fortinet-fortiweb-cwe-23"}}