ZeroDay Findings
Sign inSign up

Findings

CVE-2025-64446

Fortinet FortiWeb Path Traversal Vulnerability

Published Nov 14, 2025 · updated Jun 17, 2026 · Fortinet FortiWeb

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 14, 2025 · Catalog

    Detected

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

  2. Nov 14, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Nov 21, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Nov 21, 2025

Affected

  • cpe fortinet/fortiwebversion unspecified
  • vendor Fortinet FortiWebversion unspecified

Sources

  • CISA KEVCVE-2025-64446

    Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

    cisa.gov
  • CVE.orgCVE-2025-64446

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-64446

    30-day exploitation probability 91.8%

    first.org
  • Exploit Database52495

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database52502

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_admin/http/fortinet_fortiweb_create_admin

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_linux/http/fortinet_fortiweb_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2025-64446

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via cr

    nvd.nist.gov

References