Fortinet FortiWeb Vulnerability Actively Exploited

Security researchers and federal authorities have issued urgent warnings about a critical vulnerability in Fortinet's FortiWeb web application firewall that has been actively exploited by attackers for weeks, allowing unauthenticated access to administrative controls on affected devices worldwide.

The flaw, tracked as CVE-2025-64446, combines a relative path traversal issue with an authentication bypass mechanism. It enables attackers to send crafted HTTP or HTTPS requests to vulnerable instances, bypassing security protections to reach internal CGI endpoints and impersonate administrators. Once inside, they can execute commands, create new admin accounts, and potentially achieve full remote code execution. Fortinet rated the vulnerability's severity at 9.1 out of 10 on the CVSS scale, though some researchers assessed it closer to 9.8, emphasizing its ease of exploitation without credentials.

Exploitation began as early as early October 2025, according to multiple security firms that detected attempts on honeypots and internet-facing systems. Researchers from Defused first captured real-world attacks on October 6, publishing a proof-of-concept exploit shortly after. WatchTowr...