9.8

CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
Published 14-11-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-64446 is a critical (CVSS 9.8) Relative Path Traversal vulnerability in Fortinet FortiWeb. It is known to be exploited: CISA lists it, first on 14-11-2025. EPSS estimates a 91.97% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
91.97%
0%100%
Critical · +0.13 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits5github, metasploit, exploit-database

Timeline

  1. 14-11-2025
    PublishedVulnerability first disclosed.
  2. 14-11-2025
    Added to CISA KEVFortinet FortiWeb Path Traversal Vulnerability
  3. 21-11-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

91.97%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.13 pp

From 91.84% on 22-09-2026

22-09-202622-10-2026
EPSS score
91.97%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
14-11-2025
Federal due date
21-11-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. www.fortiguard.com/psirt/FG-IR-25-910 nvd.nist.gov/vuln/detail/CVE-2025-64446

Public exploits

5 found
  • githubUnverified

    Watchtowr Vs Fortiweb Authbypass

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Fortinet FortiWeb create new local admin

    auxiliary/admin/http/fortinet_fortiweb_create_admin

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Fortinet FortiWeb unauthenticated RCE

    exploit/linux/http/fortinet_fortiweb_rce

    Maturity: weaponized

Show all 5 exploits
  • exploit-databasemultipleUnverified

    Fortinet FortiWeb v8.0.1 - Auth Bypass

    Maturity: poc

  • exploit-databasemultipleUnverified

    FortiWeb 8.0.2 - Remote Code Execution

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Fortinet1 product
  • fortiweb≥ 8.0.0, ≤ 8.0.1 | ≥ 7.6.0, ≤ 7.6.4 | ≥ 7.4.0, ≤ 7.4.9 | ≥ 7.2.0, ≤ 7.2.11 | ≥ 7.0.0, ≤ 7.0.11 | ≥ 7.0.0, < 7.0.12 | ≥ 7.2.0, < 7.2.12 | ≥ 7.4.0, < 7.4.10 | ≥ 7.6.0, < 7.6.5 | ≥ 8.0.0, < 8.0.2

1 vendor · 1 product

References

3 links