In November 2025, Fortinet disclosed CVE-2025-64446, a path traversal vulnerability in FortiWeb that allows an unauthenticated attacker to bypass authentication and reach administrative functionality. Fortinet's advisory rates it critical, and CISA added it to the Known Exploited Vulnerabilities catalog shortly after public exploitation was observed. Because FortiWeb sits in front of web applications and often terminates TLS for internal services, a bypass here is not a single-app problem — it is a gateway problem. This article walks through the flaw, affected versions, attacker TTPs, a working Sigma rule, and the exact patch and hardening steps defenders should take this week.
What CVE-2025-64446 actually is
CVE-2025-64446 is an unauthenticated path traversal in Fortinet FortiWeb's administrative and management interfaces. By crafting a request path that escapes the intended web root or API namespace, an attacker can reach endpoints that are supposed to require an authenticated session. In practice this yields authentication bypass, which is the critical first step in a chain that ends in configuration changes, credential theft, or lateral movement into protected applications.
Fortinet published the vulnerability in its FortiGuard PSIRT advisory FG-IR-25-910, and the U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog after observing exploitation in the wild. The NVD entry (CVE-2025-64446) carries a critical CVSS score in the 9.x range, reflecting the combination of no authentication required, low attack complexity, and high confidentiality and integrity impact.
The class of bug is not exotic. Path traversal has been exploited against edge devices for years because these appliances frequently normalize URLs inconsistently between their reverse-proxy layer and their application layer. When the proxy sees /api/v2/cmdb/system/admin and the backend resolves /api/v2/../.. differently, an attacker can slip past the auth middleware. FortiWeb's role as a WAF and load balancer makes it a high-value target: compromise it and you can often observe or rewrite the traffic of every application behind it.
Affected versions and the patch matrix
Fortinet's advisory lists the affected branches and the fixed releases. The pattern is familiar: multiple maintained branches, each with its own patched build. Administrators should confirm their exact build number before assuming they are safe, because FortiWeb's GUI sometimes reports a branch version that does not include the latest patch level.
- FortiWeb 7.4.x — upgrade to the latest 7.4 release identified in the advisory (7.4.8 or later per Fortinet's fix table).
- FortiWeb 7.2.x — upgrade to the fixed 7.2 maintenance release named in FG-IR-25-910.
- FortiWeb 7.0.x — upgrade to the fixed 7.0 release; older 7.0 builds remain vulnerable.
- FortiWeb 6.4.x and earlier — Fortinet's advisory directs customers to migrate to a supported branch, as 6.4 is end-of-support.
Always cross-check the exact fixed build against the FortiGuard PSIRT advisory rather than relying on a blog summary, since Fortinet occasionally updates the fix table as new branches reach end-of-support. The NVD record mirrors the advisory and is a useful secondary source for CVE metadata and CVSS vector strings.
Attacker TTPs observed in the wild
Public reporting and Fortinet's own telemetry describe a chain that starts with reconnaissance and ends with persistence on the appliance. Mapped to MITRE ATT&CK, the relevant techniques are:
- T1190 — Exploit Public-Facing Application: the initial access vector. The attacker sends crafted HTTP requests to the FortiWeb management interface.
- T1078 — Valid Accounts: after bypassing authentication, the attacker may create or modify administrative accounts to retain access.
- T1059.004 — Command and Scripting Interpreter: Unix Shell: post-exploitation activity on the appliance's underlying Linux OS, typically to drop tooling or read configuration.
- T1552.001 — Unsecured Credentials: Credentials In Files: FortiWeb stores configuration and, in some deployments, secrets that are valuable for pivoting to backend applications.
- T1090 — Proxy: because FortiWeb is a reverse proxy, a compromised appliance can be used to relay or manipulate traffic to internal services.
Defenders should assume that any confirmed exploitation means the appliance should be treated as fully compromised. Re-imaging or factory-resetting and restoring from a known-good configuration is the safer path than attempting to clean in place. Fortinet's advisory and CISA's KEV entry both emphasize that exploitation is active, not theoretical.
Detection: Sigma, YARA, and network signatures
The most reliable detection signal for CVE-2025-64446 is an HTTP request to the FortiWeb management interface containing traversal sequences in the URI path. The following Sigma rule targets web-server and reverse-proxy logs that record the raw request URI. It is written for the standard Sigma logsource and compiles cleanly with sigma convert.
title: FortiWeb Path Traversal Auth Bypass Attempt (CVE-2025-64446)
id: 8f3c2b1a-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects URI paths containing traversal sequences targeting FortiWeb management endpoints.
references:
- https://www.fortiguard.com/psirt/FG-IR-25-910
- https://nvd.nist.gov/vuln/detail/CVE-2025-64446
author: CybernytronX
date: 2025/11/20
logsource:
category: webserver
detection:
selection_method:
cs-method:
- GET
- POST
selection_uri:
cs-uri-stem|contains:
- '/../'
- '%2e%2e%2f'
- '%2e%2e/'
- '..%2f'
- '%252e%252e%252f'
selection_target:
cs-uri-stem|contains:
- '/api/v2/'
- '/api/v1/'
- '/login'
- '/system/'
condition: selection_method and selection_uri and selection_target
falsepositives:
- Legitimate application paths that contain encoded dots
level: high
tags:
- attack.initial_access
- attack.t1190
For host-level detection, a YARA rule can flag dropped web shells or exploit artifacts on the appliance filesystem. The rule below matches common PHP and JSP web-shell indicators that have appeared alongside edge-device exploitation campaigns.
rule FortiWeb_Webshell_Indicators
{
meta:
author = "CybernytronX"
description = "Detects common webshell patterns on FortiWeb appliances"
reference = "https://www.fortiguard.com/psirt/FG-IR-25-910"
strings:
$php1 = "eval($_POST[" ascii
$php2 = "system($_GET[" ascii
$jsp1 = "Runtime.getRuntime().exec(" ascii
$jsp2 = "ProcessBuilder(" ascii
condition:
any of them
}
At the network layer, a Suricata rule can alert on encoded traversal in the request line. Tune the $HOME_NET and port variables to your FortiWeb management VLAN.
alert http any any -> $HOME_NET any (msg:"Possible FortiWeb Path Traversal Auth Bypass CVE-2025-64446"; flow:to_server,established; http.uri; content:".."; nocase; http.uri; content:"%2e%2e"; nocase; http.uri; content:"/api/"; nocase; classtype:attempted-admin; sid:1000644; rev:1;)
These rules are starting points, not finished detections. Expect attackers to vary encoding (double-encoding, UTF-8 overlong sequences, mixed case) and to rotate source IPs. Correlate traversal attempts with subsequent authentication events, configuration changes, and outbound connections from the appliance.
Mitigation and hardening
The primary mitigation is to upgrade to a fixed FortiWeb release as documented in FG-IR-25-910. If you cannot patch immediately, apply the following compensating controls, all of which Fortinet recommends for management-plane exposure:
- Restrict management access. Bind the FortiWeb admin interface to a dedicated management VLAN and allow only trusted jump hosts. Do not expose the management GUI or API to the internet.
- Disable unused interfaces. Turn off HTTP admin access where HTTPS is sufficient, and disable the API if it is not in use.
- Enforce MFA. FortiWeb supports multi-factor authentication for administrator logins; enable it for every account, including service accounts.
- Rotate secrets. If the appliance was internet-exposed before patching, rotate administrative credentials, API tokens, and any certificates or keys stored on the device.
- Review logs for IOCs. Search for traversal patterns, unexpected admin account creation, and outbound connections to unfamiliar hosts.
CISA's KEV catalog entry for CVE-2025-64446 carries a remediation due date for U.S. federal agencies, which is a useful forcing function for prioritization in any organization. Treat it as a top-tier emergency change.
Why this matters for defenders
Edge appliances keep producing critical auth bypasses because they combine three properties: they are internet-facing, they are rarely instrumented with EDR, and they hold trust relationships with everything behind them. CVE-2025-64446 is the latest in a long line of Fortinet, Ivanti, Citrix, and F5 bugs that follow this pattern. The strategic lesson is not "patch faster" — it is that the management plane of these devices must be treated as a tier-0 asset, segmented, monitored, and inventoried with the same rigor as a domain controller. If your FortiWeb management interface is reachable from the internet, you do not have a vulnerability management problem; you have an architecture problem. Fix the architecture, then patch, then verify with the detection rules above.
Sources
- Fortinet FortiGuard PSIRT Advisory FG-IR-25-910 — authoritative advisory for CVE-2025-64446, including affected versions and fixed releases.
- NVD — CVE-2025-64446 — CVE metadata, CVSS vector, and references to vendor advisories.
- CISA Known Exploited Vulnerabilities Catalog — confirms active exploitation and provides federal remediation timelines.
Frequently Asked Questions
Is CVE-2025-64446 being exploited in the wild?
Yes. CISA added CVE-2025-64446 to the Known Exploited Vulnerabilities catalog, which is reserved for vulnerabilities with confirmed exploitation. Fortinet's advisory FG-IR-25-910 also references observed exploitation. Treat any internet-exposed, unpatched FortiWeb as compromised until proven otherwise.
Which FortiWeb versions are affected?
Multiple maintained branches are affected, including 7.4.x, 7.2.x, and 7.0.x builds prior to the fixed releases named in FG-IR-25-910. FortiWeb 6.4.x and earlier are end-of-support and should be migrated. Always verify your exact build number against Fortinet's fix table.
Does the vulnerability require authentication?
No. CVE-2025-64446 is an unauthenticated path traversal that bypasses authentication. That is why its CVSS score is in the critical range and why it is prioritized for emergency patching.
What should I do if I cannot patch immediately?
Restrict management interface access to a trusted management VLAN, disable the API and HTTP admin access if unused, enforce MFA for all administrators, and monitor logs for traversal patterns. These are compensating controls, not substitutes for patching.
How do I know if my FortiWeb was compromised?
Look for HTTP requests containing traversal sequences in the URI, unexpected administrator account creation, configuration changes you did not make, and outbound connections from the appliance to unfamiliar hosts. Because the appliance is a trust anchor, re-imaging and restoring from a known-good configuration is the safest remediation.
Is FortiWeb the same as FortiGate or FortiManager?
No. FortiWeb is Fortinet's web application firewall and load balancer product. CVE-2025-64446 affects FortiWeb specifically; FortiGate and FortiManager have separate advisories and should be tracked independently.
Need expert help with this?
If your FortiWeb estate is internet-exposed or you are unsure whether CVE-2025-64446 has been exploited against your environment, CybernytronX can help. We perform targeted edge-appliance assessments, build detection content for your SOC, and deploy Ethereon, our AI-driven threat detection platform, to surface exploitation attempts across your perimeter. Reach out at cybernytronx.com/contact.html or explore Ethereon to see how we operationalize edge-device telemetry.