9.4 Critical Exploited

CVE-2025-64446 Fortinet FortiWeb Path Traversal Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-23

Description

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Affected products and versions

Product	Affected versions	Fixed in
FortiWeb 8.0	8.0.0 → 8.0.1	No fix stated
FortiWeb 7.6	7.6.0 → 7.6.4	No fix stated
FortiWeb 7.4	7.4.0 → 7.4.9	No fix stated
FortiWeb 7.2	7.2.0 → 7.2.11	No fix stated
FortiWeb 7.0	7.0.0 → 7.0.11	No fix stated

References

fortiguard.fortinet.com fortiguard.fortinet.com

Timeline

Published November 14, 2025
Added to the KEV catalogue November 14, 2025
Last modified February 26, 2026

The 74 CVEs of FortiWeb →

CVE-2026-26035 An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb… 8.8 High CVE-2026-70466 A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through… 4.8 Medium CVE-2026-40688 An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0… 6.7 Medium CVE-2026-39811 A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6,… 4.4 Medium

Track this CVE