Fortinet FortiWeb Vulnerability Exploited (CVE-2025-64446)

THE THREAT

On November 14th, Fortinet disclosed an actively exploited critical vulnerability impacting FortiWeb Web Application Firewall (WAF) versions 8.0.1 and earlier. The vulnerability, tracked as CVE-2025-64446 (CVSS: 9.8), is a path traversal vulnerability in FortiWeb that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. The flaw was first identified by Defused through honeypot captures on October 6th, 2025. watchTowr Labs confirmed the vulnerability's existence by creating a Proof-of-Concept (PoC) and released an artifact generator tool to help identify vulnerable systems. Following the emerging reports of exploitation, CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog on November 14th, giving federal agencies until November 21st to apply relevant patches.

Given the criticality of the vulnerability, the existence of PoC exploit code, and confirmed exploitation attempts, it is critical for organizations to apply recommended security patches immediately.

What we're doing about it

• eSentire's TRU team has developed detections within MDR Network to identify exploitation attempts
• eSentire MDR for Log service has detections in place for suspicious admin authentication and Command Line Interface (CLI) activity
• Known malicious IPs have been added to eSentire's Global Block List
• The eSentire Threat Response Unit (TRU) has performed threat hunts across the customer base
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Fortinet
• Audit devices for unauthorized admin accounts
• Review logs for suspicious requests and IP addresses
• Restrict management interfaces to trusted networks or VPN-only access
• If patching is not immediately possible, Fortinet has provided a temporary mitigation:
  • Disable HTTP or HTTPS for internet facing interfaces
• Follow Fortinet's FortiWeb best practices guide

Additional information

Fortinet has disclosed active exploitation of a critical vulnerability impacting FortiWeb Web Application Firewall (WAF) appliances. The path traversal vulnerability allows unauthenticated attackers to create administrator-level accounts on vulnerable devices. Successful exploitation grants full administrative control over the appliance. This issue significantly increases the risk of system compromise due to the placement of WAF appliances within enterprise networks.

The firm Defused observed the vulnerability being actively exploited in their honeypot environment, where attackers attempted to create unauthorized admin users through the vulnerable FortiWeb endpoint. Security researchers from PwnDefend contributed to the analysis by validating the exploit path and confirming that attackers were abusing the traversal flaw to create unauthorized administrator accounts. Rapid7's testing confirmed the vulnerability affects versions prior to 8.0.2.

watchTowr Labs provided a technical analysis and PoC of the exploit. The vulnerability consists of two components:

1. Path Traversal: /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi

   Attackers can craft a URI that begins with a valid FortiWeb API path and then traverse to the fwbcgi executable. This enables access to backend functionality that should normally be restricted.

2. Authentication Bypass via CGIINFO Header

   The fwbcgi binary includes a function called cgi_auth() that processes a Base64-encoded JSON object supplied in the HTTP_CGIINFO header. This object contains user attributes such as username, profname, vdom, and loginname. By supplying these attributes, an attacker can impersonate any user, including the built-in admin account, and inherit full administrative privileges.

Once these checks are bypassed, the attacker gains access to the cgi_process() function, which allows execution of any privileged action. Given the public availability of exploit code and ease of exploitation, attackers will target unpatched FortiWeb devices. The capability to directly create admin users without authentication makes this vulnerability particularly attractive for initial access, persistence, and lateral movement. eSentire's Threat Intelligence team assesses with high confidence that exploitation attempts of CVE-2025-64446 will become more widespread in the near future.

References:
[1] https://www.fortiguard.com/psirt/FG-IR-25-910
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-64446
[3] https://x.com/DefusedCyber/status/1975242250373517373
[4] https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass
[5] https://www.pwndefend.com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/
[6] https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/
[7] https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/
[8] https://www.cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog
[9] https://docs.fortinet.com/document/fortiweb/8.0.2/administration-guide/371582/fine-tuning-best-practices