FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover

What to do

1. Upgrade to FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12 or 7.0.12 or later
2. Until upgraded, disable HTTP/HTTPS administrative access on internet-facing interfaces
3. Audit local administrator accounts and remove any you did not create
4. Review configuration changes and logs back to at least October 2025
5. Replace unsupported 6.x appliances
6. If a rogue admin is found, rebuild from a clean image and rotate all credentials and certificates on the device

How to check if you are affected or compromised

• Review the local administrator list in the GUI or CLI and look for unknown names or trusted hosts of 0.0.0.0/0 and ::/0
• Search web logs for unexpected requests to the management GUI from unfamiliar IPs since October 2025
• Run an authenticated vulnerability check to confirm the build is fixed for both CVEs

What happened#

On November 14, 2025, Fortinet published FG-IR-25-910 for CVE-2025-64446, a relative path traversal (CWE-23) in the FortiWeb web application firewall's GUI that "may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests." Fortinet rated it CVSS 3.1 9.8 and stated it had observed exploitation in the wild. (Rapid7's write-up cites 9.1; the vendor advisory and NVD record show 9.8.)

The disclosure came weeks after the fact. Rapid7 notes that Defused posted a proof of concept captured by a honeypot on October 6, 2025, and that an alleged FortiWeb zero-day was offered on a criminal forum on November 6. FortiWeb 8.0.2 had already broken the public exploit before the advisory, and Rapid7 said it was unclear whether that was a deliberate silent fix. In Rapid7's testing, the exploit created a local admin account (named "hax0r") with the prof_admin profile and trusted hosts of 0.0.0.0/0.

Four days later Fortinet published FG-IR-25-513 for CVE-2025-58034, an authenticated OS command injection (CVSS 7.2) also exploited in the wild. CISA warned that attackers could chain the two, using the path traversal for admin access and the injection for code execution, for unauthenticated RCE. CISA added the CVEs to KEV on November 14 and 18, 2025.

Who is affected#

FortiWeb 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11 and 7.0.0 to 7.0.11 are vulnerable to CVE-2025-64446. CVE-2025-58034 reaches one build further on the 7.6 and 7.4 branches (through 7.6.5 and 7.4.10). FortiWeb 6.4 is listed as not affected, but Rapid7 confirmed on December 1, 2025 that unsupported 6.x versions are vulnerable. FortiAppSec Cloud is not affected.

Do you really need to act?#

If you run FortiWeb, this was a drop-everything bug in November 2025, and it still is for any box that missed the update. It needs no credentials, a working exploit has been public since October 2025, and a Metasploit module shipped on disclosure day. The one real precondition is reachability of the HTTP/HTTPS management service. Fortinet says restricting it to internal networks "significantly" reduces risk, and CISA adds that it does not eliminate it.

If you patched promptly and found no rogue admins, you can relax. If you are discovering an unpatched internet-facing FortiWeb now, assume compromise: an attacker with admin rights on a WAF can read decrypted traffic, change policies and pivot inward.

What to do now#

1. Upgrade to a build that fixes both CVEs: 8.0.2, 7.6.6, 7.4.11, 7.2.12 or 7.0.12 or later. Note that 7.6.5 and 7.4.10 fix only CVE-2025-64446.
2. If you cannot upgrade immediately, disable HTTP/HTTPS on internet-facing interfaces, per Fortinet's workaround.
3. After upgrading, review configuration and logs for unexpected changes and unauthorized administrator accounts, as CISA advises.
4. Retire FortiWeb 6.x appliances, which will not receive fixes.
5. For any confirmed compromise, rebuild from a known-good image and rotate admin passwords, API keys and the TLS private keys the WAF holds.

How to tell if you were hit#

The clearest artifact is a local admin you did not create. Review the administrator list in the GUI or CLI for unfamiliar accounts, especially with prof_admin and unrestricted trusted hosts. Check GUI and event logs for configuration changes and logins from unfamiliar IPs since early October 2025. Rapid7 has published a Sigma rule and IP indicators for exploitation attempts in its Intelligence Hub. A clean patch level does not prove you were never compromised.

Timeline#

• Oct 6, 2025 — Defused posts a honeypot-captured exploit, per Rapid7.
• Nov 6, 2025 — Alleged FortiWeb zero-day offered for sale on a criminal forum.
• Nov 14, 2025 — Fortinet publishes FG-IR-25-910; CISA adds CVE-2025-64446 to KEV.
• Nov 18, 2025 — Fortinet publishes FG-IR-25-513; CVE-2025-58034 added to KEV.
• Dec 1, 2025 — Rapid7 confirms unsupported FortiWeb 6.x is vulnerable.

Vulnerability records

• CVE-2025-64446 · KEV 2025-11-14 · A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0…
• CVE-2025-58034 · KEV 2025-11-18 · An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Fortinet PSIRT — FG-IR-25-910 Path confusion vulnerability in GUI (CVE-2025-64446) fortiguard.fortinet.com
2. Fortinet PSIRT — FG-IR-25-513 Multiple OS command injection in API and CLI (CVE-2025-58034) fortiguard.fortinet.com
3. CISA — Fortinet Releases Security Advisory on Relative Path Traversal Vulnerability Affecting FortiWeb cisa.gov
4. Rapid7 — Critical vulnerability in Fortinet FortiWeb exploited in the wild rapid7.com
5. NVD — CVE-2025-64446 nvd.nist.gov