CVE · Exploited · On CISA KEV

CVE-2025-64446

Fortinet FortiWeb Path Traversal Vulnerability

9.8: CVSS 3.1
1: story
NOV 14: added to KEV

Severity: 9.8 Critical · vendor score
Vendor: Fortinet
Product: FortiWeb
Published: Nov 14, 2025
Added to KEV: Nov 14, 2025
KEV deadline: Nov 21, 2025
Ransomware use: Unknown
Weakness: CWE-23

What it is

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

NOV 17
VulnerabilitiesFortinet CVE-2025-64446 Under Active AttackThat vulnerability (CVE-2025-64446) affects several versions of FortiWeb and CISA has added it to its Known Exploited Vulnerabilities catalog.DENNIS FISHER · 2 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryfortiguard.fortinet.com/psirt/FG-IR-25-910 Exploitgithub.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass