On November 14, 2025, Fortinet published an out-of-band advisory for CVE-2025-64446, a critical path traversal authentication bypass in FortiWeb. Within days, the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog after multiple threat-intelligence vendors linked exploitation to ransomware operations. Unlike typical SQL injection or command-injection bugs, this flaw lets an unauthenticated attacker reach privileged administrative functionality through crafted HTTP requests, bypassing the web application firewall's own authentication layer. This article breaks down the vulnerability mechanics, affected versions, observed attacker TTPs, and gives SOC teams a working Sigma rule plus concrete mitigation steps to close the exposure.
What is CVE-2025-64446?
CVE-2025-64446 is a path traversal vulnerability in FortiWeb that allows an unauthenticated, remote attacker to bypass authentication and access administrative endpoints. Fortinet's advisory rates it Critical with a CVSSv3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw stems from insufficient normalization of user-supplied paths before they are processed by FortiWeb's authentication middleware. By crafting a request with encoded traversal sequences, an attacker can cause the authentication check to be evaluated against a benign path while the request is ultimately routed to a protected administrative handler.
The result is full administrative access to the FortiWeb management interface, including the ability to read and modify configuration, create local admin accounts, and pivot into protected networks. Because FortiWeb is often deployed inline as a reverse proxy in front of production applications, compromise of the appliance can expose credentials, session tokens, and internal service endpoints that were never intended to be internet-reachable.
Fortinet's PSIRT advisory confirms exploitation in the wild and states that the vulnerability affects FortiWeb 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, and 6.4.0 through 6.4.3. See FortiGuard PSIRT FG-IR-25-64446 and the NVD entry.
Affected Versions and Exposure
According to the FortiGuard advisory, the following branches are affected and require upgrade:
- FortiWeb 7.4.0 – 7.4.7 (upgrade to 7.4.8 or later)
- FortiWeb 7.2.0 – 7.2.10 (upgrade to 7.2.11 or later)
- FortiWeb 7.0.0 – 7.0.10 (upgrade to 7.0.11 or later)
- FortiWeb 6.4.0 – 6.4.3 (upgrade to 6.4.4 or later)
FortiWeb appliances are widely deployed in enterprise DMZs and cloud edge environments, and internet-exposed management interfaces make them high-value targets. Organizations that cannot immediately upgrade should restrict management access to trusted networks and enable multi-factor authentication on all administrative accounts.
Attacker TTPs Observed in the Wild
Public reporting from multiple incident-response vendors links exploitation of CVE-2025-64446 to initial access brokers and ransomware affiliates. The observed kill chain maps to MITRE ATT&CK as follows:
- T1190 – Exploit Public-Facing Application: Crafted HTTP requests with encoded traversal sequences are sent to the FortiWeb management interface to bypass authentication.
- T1078 – Valid Accounts: After bypass, attackers create or modify local administrative accounts to establish persistence.
- T1059.004 – Command and Scripting Interpreter: Unix Shell: Administrative access is used to execute shell commands on the appliance for reconnaissance and lateral movement preparation.
- T1041 – Exfiltration Over C2 Channel: Configuration files, including hashed credentials and API keys, are exfiltrated to attacker-controlled infrastructure.
- T1486 – Data Encrypted for Impact: Ransomware affiliates use harvested credentials to move laterally into hypervisor and backup infrastructure.
The pattern mirrors activity previously attributed to Cl0p and other extortion crews that favor edge-device compromise over phishing. Defenders should treat FortiWeb logs as a high-fidelity source for early detection.
Detection: Sigma Rule for FortiWeb Auth Bypass Attempts
The following Sigma rule detects HTTP requests containing traversal sequences targeting FortiWeb administrative endpoints. It is designed for web server or WAF log ingestion and uses common field mappings.
title: FortiWeb CVE-2025-64446 Path Traversal Auth Bypass Attempt
description: Detects HTTP requests with encoded traversal sequences targeting FortiWeb admin endpoints
status: experimental
logsource:
category: webserver
detection:
selection_method:
cs-method:
- GET
- POST
selection_path:
cs-uri-stem|contains:
- '/api/v2.0/cmdb/'
- '/logincheck'
- '/admin/'
selection_traversal:
cs-uri-query|contains:
- '../'
- '..%2f'
- '%2e%2e%2f'
- '..%5c'
- '%252e%252e%252f'
condition: selection_method and selection_path and selection_traversal
fields:
- c-ip
- cs-uri-stem
- cs-uri-query
- cs-user-agent
falsepositives:
- Legitimate administrative tools with malformed paths
level: high
tags:
- attack.initial_access
- attack.t1190
- cve.2025.64446
In addition to the Sigma rule, SOC teams should alert on the following FortiWeb log events: successful logins from new source IPs to the management interface, creation of local admin accounts, and configuration export events outside change windows. Suricata users can adapt the same URI patterns into a simple content-match rule with http.uri and http.uri.raw buffers.
Mitigation and Patching
Fortinet has released fixed firmware for all affected branches. The authoritative remediation steps are:
- Upgrade to FortiWeb 7.4.8, 7.2.11, 7.0.11, or 6.4.4 as applicable. Validate the build against FG-IR-25-64446.
- If immediate upgrade is not possible, disable internet-facing management access and restrict administrative UI/API access to trusted management networks only.
- Enable multi-factor authentication for all FortiWeb administrators and rotate all local credentials, API keys, and SNMP community strings after patching.
- Review logs for indicators of prior compromise, including new admin accounts, unexpected configuration changes, and outbound connections to unknown IPs.
- Monitor CISA's KEV catalog for updated guidance and federal remediation deadlines.
Because ransomware affiliates have been observed using edge-device access to disable backups and exfiltrate data, patching alone is not sufficient. Organizations should verify that EDR coverage extends to hypervisor and backup infrastructure, and that offline backups are truly immutable.
Why This Matters for Defenders
CVE-2025-64446 is a reminder that security appliances are not exempt from the vulnerabilities they are meant to block. The auth bypass is trivial to exploit remotely, requires no credentials, and grants administrative control over a device that sits in the trust path of production traffic. For CISOs, the strategic takeaway is that edge-device hardening—network segmentation of management planes, mandatory MFA, and rapid patch cadence—must be treated as a Tier-0 control. For SOC analysts, the detection engineering challenge is to distinguish benign administrative traffic from traversal attempts; the Sigma rule above is a starting point, but tuning against your own FortiWeb log format is essential. Finally, the involvement of ransomware crews underscores that initial access via edge devices is now a commodity: assume that any unpatched, internet-exposed FortiWeb appliance is a candidate for exploitation and prioritize accordingly.
Sources
- FortiGuard PSIRT FG-IR-25-64446 — Fortinet's official advisory confirming affected versions, CVSS score, and fixed firmware releases.
- NVD entry for CVE-2025-64446 — National Vulnerability Database record with CVSS vector and reference links.
- CISA Known Exploited Vulnerabilities Catalog — confirms active exploitation and provides federal remediation timelines.
Frequently Asked Questions
What is CVE-2025-64446?
CVE-2025-64446 is a critical path traversal authentication bypass in FortiWeb that allows unauthenticated remote attackers to access administrative functionality. It was disclosed by Fortinet in November 2025 and has been exploited in the wild.
Which FortiWeb versions are affected?
FortiWeb 7.4.0–7.4.7, 7.2.0–7.2.10, 7.0.0–7.0.10, and 6.4.0–6.4.3 are affected. Fixed versions are 7.4.8, 7.2.11, 7.0.11, and 6.4.4 respectively, per FortiGuard FG-IR-25-64446.
Has CVE-2025-64446 been exploited by ransomware gangs?
Yes. Multiple threat-intelligence vendors and CISA's KEV catalog confirm active exploitation, with reporting linking the vulnerability to initial access for ransomware operations. Defenders should treat any unpatched, internet-exposed FortiWeb as compromised until proven otherwise.
How can I detect exploitation attempts?
Monitor web server and FortiWeb logs for HTTP requests containing traversal sequences such as ../, %2e%2e%2f, or ..%5c targeting administrative endpoints. The Sigma rule in this article provides a starting detection logic that can be tuned to your environment.
What should I do if I cannot patch immediately?
Disable internet-facing management access, restrict administrative UI and API to trusted networks, enable MFA for all admin accounts, and rotate credentials and API keys. These measures reduce but do not eliminate risk; upgrading remains the only complete fix.
Is FortiWeb the only Fortinet product affected?
No. Fortinet has issued separate advisories for other products. Always check the FortiGuard PSIRT page for the latest list of affected products and firmware versions.
Need expert help with this?
If your organization runs FortiWeb or other edge security appliances, CybernytronX can help you validate exposure, tune detection, and harden your management plane. Our team offers targeted penetration testing, SOC build-out, and threat detection engineering powered by Ethereon AI. Whether you need a rapid compromise assessment after CVE-2025-64446 or a long-term edge-device security program, we can help. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.