erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: November 14, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover. Operators of FortiWeb 7.0 through 8.0.1 (and unsupported 6.x) appliances, especially with HTTP/HTTPS management exposed.
  • Do you run any of these? Fortinet FortiWeb. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-11-21.
  • PyPI: 1 critical advisory (astrbot). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2025-64446, CVE-2025-58034

FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover

Any FortiWeb still below the fixed builds with its web GUI reachable from the internet should be presumed compromised and rebuilt, not just patched.

Must act: Operators of FortiWeb 7.0 through 8.0.1 (and unsupported 6.x) appliances, especially with HTTP/HTTPS management exposed.

Can relax: FortiAppSec Cloud customers, organizations without FortiWeb, and FortiWeb fleets that were upgraded in November 2025 and audited for rogue admins.

  1. Upgrade to FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12 or 7.0.12 or later
  2. Until upgraded, disable HTTP/HTTPS administrative access on internet-facing interfaces
  3. Audit local administrator accounts and remove any you did not create

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-64446Fortinet FortiWeb
Fortinet FortiWeb Path Traversal Vulnerability		2025-11-21

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)