Fortinet FortiWeb Vulnerability (CVE-2025-64446) Exploited in the Wild for Full Admin Takeover
A critical path-traversal vulnerability has been identified in Fortinet's FortiWeb web application firewall, actively exploited since early October 2025. This vulnerability allows unauthenticated attackers to gain full control of affected devices by…
A critical path-traversal vulnerability has been identified in Fortinet's FortiWeb web application firewall, actively exploited since early October 2025. This vulnerability allows unauthenticated attackers to gain full control of affected devices by creating unauthorized administrator accounts.
The vulnerability, detailed by watchTowr Labs on November 13, 2025, involves a chain of path traversal and authentication bypass issues that enable access to sensitive CGI scripts. Fortinet has confirmed the exploitation, assigning it CVE-2025-64446, with reports of global scans targeting exposed appliances.
The exploit begins with a path traversal in the GUI API endpoint, granting unauthenticated access to the fwbcgi binary. The CGI handler performs checks using cgi_inputcheck() and cgi_auth() . The cgi_inputcheck() passes with valid JSON payloads or absent configuration files, while cgi_auth() uses a Base64-encoded CGIINFO header to impersonate users with admin credentials.
Attackers utilize JSON payloads to create backdoor accounts with prof_admin profiles, allowing full-trust host access and custom passwords. Systems vulnerable to this exploit return HTTP 200 upon a GET request to the traversed path, while patched systems return 403.
A critical path-traversal vulnerability has been identified in Fortinet's FortiWeb web application firewall, actively exploited since early October 2025.
The vulnerability has a CVSS v3.1 base score of 9.1, indicating its critical nature due to low complexity, absence of required privileges, and significant impact on confidentiality, integrity, and availability.
Version 8.0: 8.0.0 – 8.0.1 (Fixed in 8.0.2+) Version 7.6: 7.6.0 – 7.6.4 (Fixed in 7.6.5+) Version 7.4: 7.4.0 – 7.4.9 (Fixed in 7.4.10+) Version 7.2: 7.2.0 – 7.2.11 (Fixed in 7.2.12+) Version 7.0: 7.0.0 – 7.0.11 (Fixed in 7.0.12+) Version 6.4 and 6.3: Vulnerable and End of Life (EOL)
Indicators of compromise include suspicious POST requests with python-urllib3 User-Agent, CGIINFO headers, and payloads embedding admin creation data. Exploitation surged post-disclosure, with attackers using Shodan-like queries to identify vulnerable hosts.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-64446 to its Known Exploited Vulnerabilities catalog, mandating federal remediation by November 21, 2025. Fortinet has issued patches in releases such as 8.0.2, advising the disabling of HTTP/HTTPS on internet-facing interfaces and reviewing logs for unauthorized admin accounts. Although no remote code execution beyond admin access is confirmed, compromised WAFs may facilitate lateral movement within Fortinet environments.
watchTowr has released a Detection Artefact Generator on GitHub for YARA/Sigma rules to identify exploit artifacts. It is recommended that defenders search for new local users, anomalous fwbcgi logs, and traversal URIs in proxies. Immediate upgrades, network segmentation, and zero-trust implementation for management interfaces are critical in light of ongoing exploit attempts.
Based on reporting by Cyber Security News.