critical9.8Known exploitedPublic exploit code
CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-11-14. Federal due date: 2025-11-21.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FortiWeb 8.0.2 - Remote Code Execution2026-04-08 · webapps · multiple
- Fortinet FortiWeb v8.0.1 - Auth Bypass2026-04-06 · webapps · multiple
Impact
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortiweb | from 7.0.0 before 7.0.12 from 7.2.0 before 7.2.12 from 7.4.0 before 7.4.10 from 7.6.0 before 7.6.5 from 8.0.0 before 8.0.2 |