CVE-2025-64446

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-64446 9.8

Fortinet · FortiWeb · Added 2025-11-14 · Published 2025-11-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet FortiWeb Path Traversal Vulnerability

VendorFortinet

ProductFortiWeb

Date added2025-11-14

Due date2025-11-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-23

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

NVD: A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-30 14:45 UTC

Wall time15.8s

Searches3

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-64446
https://fortiguard.fortinet.com/psirt/FG-IR-25-910
https://github.com/soltanali0/CVE-2025-64446-Exploit
https://github.com/lincemorado97/CVE-2025-64446_CVE-2025-58034
https://github.com/mrk336/Silent-WebStorm-Fortinet-s-Hidden-Exploits
https://github.com/AN5I/cve-2025-64446-fortiweb-exploit
https://www.cyber.gc.ca/en/alerts-advisories/al25-017-vulnerability-impacting-fortinet-fortiweb-cve-2025-64446
https://blog.qualys.com/vulnerabilities-threat-research/2025/11/14/unauthenticated-authentication-bypass-in-fortinet-fortiweb-cve-2025-64446-exploited-in-the-wild
https://www.picussecurity.com/resource/blog/fortiweb-cve-2025-64446-vulnerability-path-traversal-leads-to-remote-code-execution
https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/fortinet-fortiweb.html

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt FortiWeb access logs for unauthenticated POSTs to /api/v2.0/ carrying a CGIINFO header (base64 JSON with profname:prof_admin) — path traversal routes to fwbcgi which accepts forged credentials and creates a new admin account.

Research details

Componentfwbcgi CGI binary (via /api/v2.0/ path traversal) and cgi_auth() authentication function accepting CGIINFO header

PreconditionsNetwork access to the FortiWeb management interface (typically TCP 443 for HTTPS); the HTTP/HTTPS management service is enabled by default; no authentication required — attacker sends a crafted HTTP/HTTPS request beginning with a valid API prefix (e.g., /api/v2.0/cmdb/system/admin%3F/) containing URL-encoded characters and directory traversal sequences (../../../../../) to route to the internal fwbcgi CGI binary at /cgi-bin/fwbcgi; a base64-encoded CGIINFO HTTP header impersonating an administrative user (e.g., username: admin, profname: super_admin) bypasses the cgi_auth() function; request body must be valid JSON (e.g., {}); no user interaction required; once authenticated, attacker can execute arbitrary administrative commands, create new admin accounts, and modify system configuration. agent

DeliveryAttacker sends an unauthenticated HTTPS POST to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi on the FortiWeb management interface. The request includes a CGIINFO HTTP header containing a base64-encoded JSON payload (e.g., {"username":"admin","profname":"prof_admin","vdom":"root"}) that bypasses cgi_auth() by impersonating an administrative user. The POST body is a JSON object (q_type: 1) specifying a new admin username and password, which the fwbcgi handler creates without authentication.

Public PoCyes

PoC URLs https://github.com/soltanali0/CVE-2025-64446-Exploit
https://github.com/lincemorado97/CVE-2025-64446_CVE-2025-58034
https://github.com/mrk336/Silent-WebStorm-Fortinet-s-Hidden-Exploits
https://github.com/AN5I/cve-2025-64446-fortiweb-exploit Third-party repos; verify before use.

Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-25-910

Exploit notesPublic PoC available (4+ repos) — significantly lowers barrier to exploitation | CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Two-bug chain: path traversal + auth bypass via CGIINFO header | Actively exploited in the wild since October 2025

SummaryCVE-2025-64446 is a critical unauthenticated remote code execution vulnerability in Fortinet FortiWeb affecting versions 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1. The flaw chains two bugs: a relative path traversal in the /api/v2.0/ management REST API endpoint that routes requests to the internal fwbcgi CGI binary, combined with an authentication bypass via a base64-encoded CGIINFO HTTP header that impersonates administrative users. An unauthenticated attacker can exploit this to create new admin accounts and execute arbitrary administrative commands on the device. Active exploitation was confirmed by Qualys in October 2025, and multiple public PoCs are available on GitHub.

Tia coverage

First reported2026-07-02

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poc

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.