← CVE Radar
CVE-2025-64446Fortinet FortiWeb Path Traversal Vulnerability
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
9.8 CRITICALEPSS 91.07%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.4 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C |
CISA required action
⚡ Known exploited · remediation due Nov 21, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-64446
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Nov 14, 2025
- Last modified
- 2026-10-18 20:10 UTC
- Weaknesses
- CWE-23 · Escalation of privilege
Affected Products
As published by the CNA in the CVE record.
FortinetFortiWeb5 version ranges
- 8.0.0 through 8.0.1
- 7.6.0 through 7.6.4
- 7.4.0 through 7.4.9
- 7.2.0 through 7.2.11
- 7.0.0 through 7.0.11