CVE-2025-64446: FortiWeb relative path traversal allows admin command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 pre-authentication network flaw with KEV listing, a public exploit reference, and EPSS above the 99th percentile.

What it is

FortiWeb contains a relative path traversal flaw (CWE-23) reachable through crafted HTTP or HTTPS requests. Successful exploitation lets an attacker execute administrative commands on the appliance, which sits on the network edge and typically holds sensitive configuration and credentials. The record lists affected branches 7.0 through 8.0 but no fixed version, so patch guidance must come from the vendor advisory.

Impact

An attacker gains the ability to run administrative commands on the FortiWeb system, effectively taking control of the appliance and anything it protects or brokers.

Attack surface

Reachable over the network via crafted HTTP or HTTPS requests to the FortiWeb interface. The CVSS vector shows no privileges required and no user interaction, so the flaw is exploitable pre-authentication.

Exploitation

CISA added it to KEV on 2025-11-14 with a 2025-11-21 remediation due date, and a public third-party exploit reference exists. EPSS is 0.91838 (99.8th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Fortinet fix for your FortiWeb branch per FG-IR-25-910; no fixed version is stated in this record, so confirm the target release with the vendor advisory.
• If patching cannot be completed by the KEV due date, restrict management and administrative interface access to trusted networks and discontinue use where mitigations are unavailable, per CISA guidance.
• Review and rotate credentials and secrets stored on or managed through FortiWeb, since administrative command execution may expose them.
• Monitor Fortinet PSIRT and CISA KEV updates for revised affected ranges and interim mitigations.

Detection

• Inspect HTTP/HTTPS request logs to FortiWeb for path traversal sequences (../, encoded variants) targeting administrative endpoints.
• Alert on unexpected administrative command execution or configuration changes on FortiWeb appliances.
• Correlate FortiWeb access logs with outbound connections or new processes that do not match normal appliance behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.