CISA Reports Active Attacks on FortiWeb WAF Vulnerability Allowing Admin Access

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet FortiWeb vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaw is being actively exploited in the wild.

The vulnerability, tracked as CVE-2025-64446, allows unauthenticated attackers to gain administrative access to affected systems via a path-traversal vulnerability.

Critical Path Traversal Flaw

CVE-2025-64446 is a relative path traversal vulnerability affecting Fortinet’s FortiWeb web application firewall.

The security flaw enables threat actors to execute administrative commands on vulnerable systems without requiring authentication.

Attackers can exploit this weakness by sending specially crafted HTTP or HTTPS requests to the targeted FortiWeb device.

The vulnerability is categorized under CWE-23 (Relative Path Traversal). This weakness occurs when software uses external input to construct a pathname but fails to correctly neutralize special elements within the path.

This allows attackers to traverse outside of a restricted directory and access files or directories that should be protected.

CISA added CVE-2025-64446 to the KEV catalog on November 14, 2025, signaling active exploitation of the vulnerability.

Federal agencies operating under Binding Operational Directive (BOD) 22-01 must apply vendor-provided mitigations by November 21, 2025.

While BOD 22-01 applies specifically to Federal Civilian Executive Branch agencies, CISA strongly recommends that all organizations prioritize remediation of cataloged vulnerabilities to reduce cyber risk.

Organizations have three remediation options: apply security patches per Fortinet’s vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of affected products if mitigations are unavailable.

The tight seven-day remediation window underscores the severity and active exploitation of this vulnerability.

According to CISA’s advisory, it remains unknown whether CVE-2025-64446 is being leveraged in ransomware campaigns.

However, the vulnerability’s ability to grant administrative access makes it an attractive target for various threat actors, including ransomware operators seeking initial access to enterprise networks.

A compromise of these security devices could give attackers deep visibility into protected applications and enable them to turn off security controls, intercept sensitive data, or pivot to other systems within the network.

Organizations using Fortinet FortiWeb should immediately check their deployments for affected versions and apply available security updates.

System administrators should review access logs for suspicious HTTP/HTTPS requests that may indicate exploitation attempts.

Additionally, organizations should implement network segmentation to limit potential lateral movement if a FortiWeb device becomes compromised.

The addition of this vulnerability to CISA’s KEV catalog reflects confirmed exploitation. It should serve as an urgent call to action for all FortiWeb users to prioritize patching and mitigation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.