CVE-2025-64446

What it actually does

CVE-2025-64446 is a critical relative path traversal vulnerability in Fortinet FortiWeb that can be triggered through crafted HTTP or HTTPS requests. By manipulating path components such as parent-directory references and encoded traversal sequences, a remote attacker may reach unintended administrative functionality and execute administrative commands on the FortiWeb system. Because FortiWeb is commonly deployed as an internet-facing web application firewall, successful exploitation can give an attacker control over a security gateway that inspects and protects downstream applications.

Why it matters to the business

Successful exploitation can result in full compromise of a FortiWeb appliance, allowing attackers to change security policy, disable inspection, create or alter administrator access, pivot toward protected applications, intercept traffic, or use the appliance as a foothold inside the network. The risk is urgent because the vulnerability is in CISA KEV, has active in-the-wild exploitation, has a very high EPSS score, and CISA set a remediation deadline of 2025-11-21. Even though ransomware use is not currently indicated, compromise of a perimeter security device can materially increase the likelihood of data theft, service disruption, and follow-on intrusion.

How an attack unfolds

An attacker first identifies an exposed FortiWeb management or web-facing interface running one of the affected versions: 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, or 7.0.0 through 7.0.11. The attacker then sends crafted HTTP or HTTPS requests containing relative path traversal payloads, often using encoded or double-encoded dot-dot-slash sequences to bypass normalization and routing checks. If the request reaches the vulnerable handler, the attacker may invoke administrative command functionality outside the intended authorization path. Post-exploitation activity may include changing FortiWeb configuration, adding administrative access, disabling protections, collecting configuration or credential material, staging files, establishing persistence, or using the appliance as a launch point toward applications behind it. Public reporting labels include active exploitation of the Fortinet FortiWeb path traversal vulnerability; threat-hunting should treat any matching traversal attempts against FortiWeb as potentially malicious, especially where followed by configuration or administrator changes.

How to fix it

Upgrade Fortinet FortiWeb to a vendor-fixed release immediately. Affected branches are FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11; move to the corresponding fixed release above the affected range or the latest available FortiWeb release recommended by Fortinet. If immediate upgrade is not possible, restrict FortiWeb administrative access to trusted management networks only, block public access to management interfaces, enforce MFA for administrative users where supported, limit source IPs at upstream firewalls, disable unnecessary administrative exposure, and monitor aggressively for traversal payloads and unexpected configuration changes. Because this is KEV-listed and actively exploited, mitigation should be treated as temporary; patching or removing exposure is the primary fix.

How to confirm the fix worked

Confirm the appliance version is no longer within the affected ranges and verify the installed build against Fortinet’s advisory or release notes. Validate that administrative interfaces are not reachable from untrusted networks and that upstream firewall or access-control rules restrict management access to approved sources. Review FortiWeb system, event, admin, and access logs for recent traversal attempts and unexpected administrative actions before and after patching. Where safe and authorized, use a vulnerability scanner or vendor-provided check to confirm the FortiWeb instance is not detected as vulnerable; avoid running public exploit code against production appliances. After remediation, verify no unauthorized administrator accounts, policy changes, startup tasks, files, or abnormal outbound connections remain.

Typical attack path

1. Scan the internet or target perimeter ranges for exposed Fortinet FortiWeb services.
2. Fingerprint the FortiWeb version or infer vulnerability from banners, responses, TLS metadata, or behavior.
3. Send crafted HTTP or HTTPS requests containing relative path traversal sequences to vulnerable FortiWeb endpoints.
4. Reach unintended administrative command execution functionality through the traversal flaw.
5. Execute administrative commands or alter appliance configuration.
6. Create persistence, add or modify administrator access, disable protections, or collect configuration data.
7. Pivot from the compromised FortiWeb appliance toward protected applications or internal network services.

How to detect it

Look for evidence in FortiWeb access logs, event logs, system logs, administrator audit logs, configuration-change logs, upstream reverse-proxy logs, firewall logs, NetFlow, DNS logs, and SIEM telemetry. Prioritize requests containing path traversal sequences, especially encoded or double-encoded variants, followed by successful responses, configuration changes, administrator logins, new administrator creation, policy disablement, system command activity, appliance reboots, configuration exports, or unusual outbound traffic. Correlate suspicious HTTP/S requests with source IPs that subsequently authenticate, trigger admin actions, or cause FortiWeb system events. Review for unexpected changes to WAF policies, protected server definitions, routing, certificates, authentication configuration, local users, backup/export activity, and logging settings. Because exploitation is reported in the wild, absence of a crash does not rule out compromise; focus on suspicious requests plus post-request state changes. If threat-intel tags or case names referencing Fortinet FortiWeb path traversal exploitation or LANDFALL-related activity appear in tooling, use them as enrichment but validate against appliance logs and artifacts.

• ../
• ..\
• ..%2f
• ..%2F
• %2e%2e%2f
• %2E%2E%2F
• %252e%252e%252f
• %252E%252E%252F
• ..%252f
• ..%255c
• %c0%ae%c0%ae%c0%af
• %uff0e%uff0e%u2215
• /../
• /..%2f
• /..%252f
• path traversal
• relative path traversal
• admin command
• configuration changed
• administrator account created
• policy disabled
• config export
• FortiWeb
• LANDFALL

What your security team should do

• Treat all internet-exposed affected FortiWeb instances as emergency remediation priorities because the vulnerability is KEV-listed, has active exploitation, and has high exploitation probability.
• Upgrade FortiWeb to the latest vendor-fixed release, prioritizing externally reachable appliances first.
• Immediately restrict administrative access to trusted source networks and remove direct internet exposure for management interfaces.
• Hunt FortiWeb, proxy, firewall, and SIEM logs for traversal payloads, encoded dot-dot-slash sequences, and administrative actions following suspicious requests.
• Review FortiWeb administrator accounts, authentication settings, configuration exports, WAF policy changes, and recent command or system events for unauthorized activity.
• Rotate FortiWeb administrative credentials and any secrets stored on or accessible from the appliance if exploitation is suspected.
• Check for outbound connections from FortiWeb to unusual external IPs, newly created scheduled tasks or persistence mechanisms, and changes that weaken inspection or logging.
• If compromise is suspected, preserve logs and configuration, isolate the appliance, rebuild or restore from a known-good image, and reintroduce it only after patching and credential rotation.