---
id: "CVE-2025-64446"
kind: "vulnerability"
aliases: ["CVE-2025-64446"]
title: "A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "fortinet fortiweb", "fixed": ["7.0.12"], "affected": ">= 7.0.0, < 7.0.12", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.2.12"], "affected": ">= 7.2.0, < 7.2.12", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.4.10"], "affected": ">= 7.4.0, < 7.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.6.5"], "affected": ">= 7.6.0, < 7.6.5", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["8.0.2"], "affected": ">= 8.0.0, < 8.0.2", "ecosystem": "vendor"}, {"name": "Fortinet FortiWeb", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortinet", "fortiweb", "infrastructure", "self-hosted", "waf"]
not_affected_if: ["unknown"]
published_at: "2025-11-14T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-64446", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64446", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4,…

Fortinet FortiWeb, a web application firewall appliance, has a relative path traversal flaw that lets crafted HTTP or HTTPS requests reach administrative functions. An unauthenticated attacker can run administrative commands on the device, and CISA lists it as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fortinet fortiweb affected >= 7.0.0, < 7.0.12 fixed 7.0.12
- vendor:fortinet fortiweb affected >= 7.2.0, < 7.2.12 fixed 7.2.12
- vendor:fortinet fortiweb affected >= 7.4.0, < 7.4.10 fixed 7.4.10
- vendor:fortinet fortiweb affected >= 7.6.0, < 7.6.5 fixed 7.6.5
- vendor:fortinet fortiweb affected >= 8.0.0, < 8.0.2 fixed 8.0.2
- vendor:Fortinet FortiWeb affected ? fixed ?

## Fix

Apply the mitigations in the vendor instructions referenced by CISA; the sources do not name a fixed version. If mitigations are unavailable, discontinue use of the product per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-64446
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-64446

## From the sources

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_