Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-64446

CVE-2025-64446CRITICAL

Fortinet FortiWeb

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.4   .9184   99.8   YES

AFFECTED
  Product   Versions  Fixed
  FortiWeb  8.0.0 –   —

TIMELINE
  Nov 4   Reserved by fortinet
  Nov 14  Added to CISA KEV, remediation due 2025-11-21
  Nov 14  Published (CNA: fortinet)

CWE-23 · CNA: fortinet · CVSS v3.1 · 3 references · KEV due November 21, 2025

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
November 4, 2025	Reserved	Reserved by fortinet
November 14, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-11-21
November 14, 2025	Published	Published (CNA: fortinet)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Fortinet	FortiWeb	—	8.0.0	—

Weaknesses

CWE-23

References (3)

https://fortiguard.fortinet.com/psirt/FG-IR-25-910
https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass [exploit]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446 [government-resource]

Authoritative record: CVE-2025-64446 at cve.org

Vendors: fortinet

Weaknesses: CWE-23

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-64446 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.