CVE-2025-64446

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 18, 2026

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.9; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.11

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-910Vendor Advisory
https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypassExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446US Government Resource

Timeline

Published: Nov 14, 2025
Last modified: Oct 18, 2026
Added to CISA KEV: Nov 14, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644478.1A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 throu CVE-2025-64458.1ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra CVE-2025-644567.8In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation CVE-2025-644577.0In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition CVE-2025-644587.5An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a CVE-2025-644599.1An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`CVE-2025-64469.8A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. This issue affects some unknow CVE-2025-644607.5An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xm CVE-2025-644617.8There is an out of bounds write vulnerability in NI LabVIEW in mgocre_SH_25_3!RevBL() when parsing a corrupted VI file. This vulnerability CVE-2025-644627.8There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file. This vulnera CVE-2025-644637.8There is an out of bounds read vulnerability in NI LabVIEW in LVResource::DetachResource() when parsing a corrupted VI file. This vulnerabi CVE-2025-644647.8There is an out of bounds read vulnerability in NI LabVIEW in lvre!VisaWriteFromFile() when parsing a corrupted VI file. This vulnerability