---
title: "FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover"
url: https://erroneo.us/security/briefs/fortiweb-cve-2025-64446-path-traversal/
description: "FortiWeb path traversal lets unauthenticated attackers create admin accounts; chained with CVE-2025-58034 for RCE. Fixed in 8.0.2/7.6.6+. Unpatched: act now."
type: security-brief
section: "Security Digest"
date_published: 2025-11-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2025-64446", "CVE-2025-58034"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover

**Verdict: Act now.** Any FortiWeb still below the fixed builds with its web GUI reachable from the internet should be presumed compromised and rebuilt, not just patched.

- **Who must act:** Operators of FortiWeb 7.0 through 8.0.1 (and unsupported 6.x) appliances, especially with HTTP/HTTPS management exposed.
- **Who can relax:** FortiAppSec Cloud customers, organizations without FortiWeb, and FortiWeb fleets that were upgraded in November 2025 and audited for rogue admins.
- **Affected:** FortiWeb 8.0.0 through 8.0.1; FortiWeb 7.6.0 through 7.6.4 (7.6.5 for CVE-2025-58034); FortiWeb 7.4.0 through 7.4.9 (7.4.10 for CVE-2025-58034); FortiWeb 7.2.0 through 7.2.11; FortiWeb 7.0.0 through 7.0.11; Unsupported FortiWeb 6.x (per Rapid7)
- **Fixed:** FortiWeb 8.0.2; FortiWeb 7.6.6 (7.6.5 fixes CVE-2025-64446 only); FortiWeb 7.4.11 (7.4.10 fixes CVE-2025-64446 only); FortiWeb 7.2.12; FortiWeb 7.0.12
- **CVEs:** CVE-2025-64446, CVE-2025-58034
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade to FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12 or 7.0.12 or later
2. Until upgraded, disable HTTP/HTTPS administrative access on internet-facing interfaces
3. Audit local administrator accounts and remove any you did not create
4. Review configuration changes and logs back to at least October 2025
5. Replace unsupported 6.x appliances
6. If a rogue admin is found, rebuild from a clean image and rotate all credentials and certificates on the device

### How to check if you are affected

- Review the local administrator list in the GUI or CLI and look for unknown names or trusted hosts of 0.0.0.0/0 and ::/0
- Search web logs for unexpected requests to the management GUI from unfamiliar IPs since October 2025
- Run an authenticated vulnerability check to confirm the build is fixed for both CVEs

## What happened

On November 14, 2025, Fortinet published [FG-IR-25-910](https://fortiguard.fortinet.com/psirt/FG-IR-25-910) for CVE-2025-64446, a relative path traversal (CWE-23) in the FortiWeb web application firewall's GUI that "may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests." Fortinet rated it CVSS 3.1 9.8 and stated it had observed exploitation in the wild. (Rapid7's write-up cites 9.1; the vendor advisory and [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2025-64446) show 9.8.)

The disclosure came weeks after the fact. [Rapid7](https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/) notes that Defused posted a proof of concept captured by a honeypot on October 6, 2025, and that an alleged FortiWeb zero-day was offered on a criminal forum on November 6. FortiWeb 8.0.2 had already broken the public exploit before the advisory, and Rapid7 said it was unclear whether that was a deliberate silent fix. In Rapid7's testing, the exploit created a local admin account (named "hax0r") with the `prof_admin` profile and trusted hosts of 0.0.0.0/0.

Four days later Fortinet published [FG-IR-25-513](https://fortiguard.fortinet.com/psirt/FG-IR-25-513) for CVE-2025-58034, an authenticated OS command injection (CVSS 7.2) also exploited in the wild. [CISA warned](https://www.cisa.gov/news-events/alerts/2025/11/14/fortinet-releases-security-advisory-relative-path-traversal-vulnerability-affecting-fortiweb) that attackers could chain the two, using the path traversal for admin access and the injection for code execution, for unauthenticated RCE. CISA added the CVEs to KEV on November 14 and 18, 2025.

## Who is affected

FortiWeb 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11 and 7.0.0 to 7.0.11 are vulnerable to CVE-2025-64446. CVE-2025-58034 reaches one build further on the 7.6 and 7.4 branches (through 7.6.5 and 7.4.10). FortiWeb 6.4 is listed as not affected, but Rapid7 confirmed on December 1, 2025 that unsupported 6.x versions are vulnerable. FortiAppSec Cloud is not affected.

## Do you really need to act?

If you run FortiWeb, this was a drop-everything bug in November 2025, and it still is for any box that missed the update. It needs no credentials, a working exploit has been public since October 2025, and a Metasploit module shipped on disclosure day. The one real precondition is reachability of the HTTP/HTTPS management service. Fortinet says restricting it to internal networks "significantly" reduces risk, and CISA adds that it does not eliminate it.

If you patched promptly and found no rogue admins, you can relax. If you are discovering an unpatched internet-facing FortiWeb now, assume compromise: an attacker with admin rights on a WAF can read decrypted traffic, change policies and pivot inward.

## What to do now

1. Upgrade to a build that fixes both CVEs: 8.0.2, 7.6.6, 7.4.11, 7.2.12 or 7.0.12 or later. Note that 7.6.5 and 7.4.10 fix only CVE-2025-64446.
2. If you cannot upgrade immediately, disable HTTP/HTTPS on internet-facing interfaces, per Fortinet's workaround.
3. After upgrading, review configuration and logs for unexpected changes and unauthorized administrator accounts, as CISA advises.
4. Retire FortiWeb 6.x appliances, which will not receive fixes.
5. For any confirmed compromise, rebuild from a known-good image and rotate admin passwords, API keys and the TLS private keys the WAF holds.

## How to tell if you were hit

The clearest artifact is a local admin you did not create. Review the administrator list in the GUI or CLI for unfamiliar accounts, especially with `prof_admin` and unrestricted trusted hosts. Check GUI and event logs for configuration changes and logins from unfamiliar IPs since early October 2025. Rapid7 has published a Sigma rule and IP indicators for exploitation attempts in its Intelligence Hub. A clean patch level does not prove you were never compromised.

## Timeline

- Oct 6, 2025 — Defused posts a honeypot-captured exploit, per Rapid7.
- Nov 6, 2025 — Alleged FortiWeb zero-day offered for sale on a criminal forum.
- Nov 14, 2025 — Fortinet publishes FG-IR-25-910; CISA adds CVE-2025-64446 to KEV.
- Nov 18, 2025 — Fortinet publishes FG-IR-25-513; CVE-2025-58034 added to KEV.
- Dec 1, 2025 — Rapid7 confirms unsupported FortiWeb 6.x is vulnerable.

## Sources

1. [Fortinet PSIRT — FG-IR-25-910 Path confusion vulnerability in GUI (CVE-2025-64446)](https://fortiguard.fortinet.com/psirt/FG-IR-25-910)
2. [Fortinet PSIRT — FG-IR-25-513 Multiple OS command injection in API and CLI (CVE-2025-58034)](https://fortiguard.fortinet.com/psirt/FG-IR-25-513)
3. [CISA — Fortinet Releases Security Advisory on Relative Path Traversal Vulnerability Affecting FortiWeb](https://www.cisa.gov/news-events/alerts/2025/11/14/fortinet-releases-security-advisory-relative-path-traversal-vulnerability-affecting-fortiweb)
4. [Rapid7 — Critical vulnerability in Fortinet FortiWeb exploited in the wild](https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/)
5. [NVD — CVE-2025-64446](https://nvd.nist.gov/vuln/detail/CVE-2025-64446)

---
Source page: https://erroneo.us/security/briefs/fortiweb-cve-2025-64446-path-traversal/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt