CRITICAL Actively exploited CWE-23
CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet·FortiWeb
9.4/ 10
CVSS 3.1
Critical severity
91%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.8% of all CVEs
Listed
CISA KEV catalog
- Added
- Nov 14, 2025
- Fix due
- Nov 21, 2025
- Ransomware
- Not known
Timeline
- Published
- Nov 14, 2025
- Updated
- Feb 26, 2026
- First covered
- Jul 2, 2026
- Latest story
- 4 months ago
Summary
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
CWE-23Escalation of privilege
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:CCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Fortinet FortiWeb8.0.0 to 8.0.17.6.0 to 7.6.47.4.0 to 7.4.97.2.0 to 7.2.11