Overview

A critical vulnerability has been discovered in Fortinet FortiWeb (WAF appliance) that allows an unauthenticated attacker to execute administrative commands by exploiting a path traversal and authentication bypass flaw in the management interface. This vulnerability is actively exploited and listed in the CISA Know Exploited Vulnerabilities (KEV) Catalogue.

Description

The vulnerability, CVE-2025-64446, arises from a relative path traversal flaw combined with authentication bypass logic in FortiWeb’s API/GUI management interface. 

An attacker sends a crafted HTTP/HTTPS POST request to a vulnerable endpoint (for example: /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi) which bypasses intended authentication controls and reaches a legacy CGI handler. 

Through this access, the attacker can create administrative accounts, modify configuration, execute arbitrary commands on the device and pivot into the network.

Impact

Successful exploitation of this vulnerability can result in:

·       Full administrative control of the FortiWeb appliance.

·       Potential exposure of all web-application firewall managed assets.

·       Lateral movement opportunity into protected networks behind the WAF.

·       Attackers may install backdoors, modify policies, disrupt services or exfiltrate sensitive data.

Severity:

·       CVSS Score: 9.8 (Critical)

·       Attack Vector: Network

·       Privileges Required: None

·       User Interaction: None

·       Status: Actively Exploited

Solution

Fortinet has released a security patch for this vulnerability. Users and administrators are encouraged to apply necessary updates.

Indicators of Compromise (IoCs):

·       Unexpected POST requests to URLs containing path-traversal sequences (e.g., /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi). 

·       New administrative accounts appearing on FortiWeb appliances without legitimate change.

References

• 1. https://fortiguard.fortinet.com/psirt/FG-IR-25-910
• 2. https://socprime.com/active-threats/cve-2025-64446/
• 3. https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild
• 4. https://nvd.nist.gov/vuln/detail/CVE-2025-64446
• 5. https://arcticwolf.com/resources/blog/cve-2025-64446