CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability

Critical severity · published Nov 14, 2025

CVE-2025-64446

Fortinet FortiWeb Path Traversal Vulnerability

In wildKEV

9.8

CVSS

91.1%

EPSS

Yes

On KEV

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)91.1% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 14, 2025

Federal remediation dueNov 21, 2025

Ransomware campaign useNot known

Affected products

Which versions

FortiWeb · Fortinet

8.0.0 through 8.0.1; 7.6.0 through 7.6.4; 7.4.0 through 7.4.9; 7.2.0 through 7.2.11; 7.0.0 through 7.0.11 · source: vendor, NVD, KEV

In the news

VulnerabilityHigh

[CISA KEV] CVE-2025-64446: Fortinet FortiWeb - Fortinet FortiWeb Path Traversal Vulnerability

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

FOFortiWebCVE-2025-64446

Nov 14, 2025·CISA KEV

Affected product

FortiWeb

Fortinet

All FortiWeb CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-64446

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-64446

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

fortiguard.fortinet.com

https://fortiguard.fortinet.com/psirt/FG-IR-25-910