VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 11:19 UTC
← Dashboard

CVE-2025-64446

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via cr…

Read full description
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
CVSS 9.4 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.8/10
REALITY · THREAT PRIORITY
8.9/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.4: +1.41
  • Fresh EPSS: 91.08%: +0.46

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 28 documents and public datasets.

Hype components

Headline sample (25%)
60/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL18/100

Sources and documents

The Hacker News
Press · 23 Oct 2026, 13:50 · Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - The Hacker News
Recorded Future
Press · 09 Dec 2025, 08:00 · November 2025 CVE Landscape: 10 Critical Vulnerabilities Show 69% Drop from October - Recorded Future
Cybersecurity Dive
Press · 02 Dec 2025, 08:00 · Fortinet FortiWeb flaws found in unsupported versions of web application firewall - Cybersecurity Dive
Cybersecurity Dive
Press · 20 Nov 2025, 08:00 · Researchers warn command injection flaw in Fortinet FortiWeb is under exploitation - Cybersecurity Dive
SOC Prime
Press · 19 Nov 2025, 08:00 · Fortinet FortiWeb Authentication Bypass via Path Traversal Vulnerability (CVE-2025-64446) - SOC Prime
See all 28 source documents
SecurityWeek
Press · 19 Nov 2025, 08:00 · Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week - SecurityWeek
GreyNoise
Press · 19 Nov 2025, 08:00 · FortiWeb CVE‑2025‑64446: What We’re Seeing in the Wild - GreyNoise
The Register
Press · 19 Nov 2025, 08:00 · Fortinet confirms second 0-day in just four days - The Register
BleepingComputer
Press · 18 Nov 2025, 08:00 · Fortinet warns of new FortiWeb zero-day exploited in attacks - BleepingComputer
Cyber Press
Press · 18 Nov 2025, 08:00 · Fortinet FortiWeb WAF Vulnerability Exploited in the Wild, CISA Warns of Admin Access Risk - Cyber Press
Cyber Daily
Press · 17 Nov 2025, 08:00 · US cyber agency warns of active exploitation of Fortinet FortiWeb path traversal vulnerability - Cyber Daily
Cybersecurity Dive
Press · 17 Nov 2025, 08:00 · Critical vulnerability in Fortinet FortiWeb is under exploitation - Cybersecurity Dive
CCB Belgium
Press · 17 Nov 2025, 08:00 · Warning: Path Traversal Vulnerability in Fortinet FortiWeb - Patch Immediately! - CCB Belgium
CyberScoop
Press · 17 Nov 2025, 08:00 · Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage - CyberScoop
CyberSecurityNews
Press · 17 Nov 2025, 08:00 · CISA Warns of Fortinet FortiWeb WAF Vulnerability Exploited in the Wild to Gain Admin Access - CyberSecurityNews
Cyber Security Agency of Singapore
Press · 17 Nov 2025, 08:00 · Critical Vulnerability in FortiWeb Web Application Firewall - Cyber Security Agency of Singapore
The Record from Recorded Future News
Press · 17 Nov 2025, 08:00 · CISA gives federal agencies one week to patch exploited Fortinet bug - The Record from Recorded Future News
CyberSecurityNews
Press · 15 Nov 2025, 08:00 · Critical FortiWeb WAF Flaw Exploited in the Wild, Enabling Full Admin Takeover - CyberSecurityNews
Help Net Security
Press · 14 Nov 2025, 08:00 · A suspected Fortinet FortiWeb zero-day is actively exploited, researchers warn - Help Net Security
SecurityWeek
Press · 14 Nov 2025, 08:00 · Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability - SecurityWeek
Qualys
Press · 14 Nov 2025, 08:00 · Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild - Qualys
The Register
Press · 14 Nov 2025, 08:00 · Fortinet finally cops to critical make-me-admin bug under active exploitation - The Register
watchTowr Labs
Press · 14 Nov 2025, 08:00 · When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) - watchTowr Labs
BleepingComputer
Press · 14 Nov 2025, 08:00 · Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks - BleepingComputer
Bitsight
Press · 14 Nov 2025, 08:00 · Security Alert: CVE-2025-64446 Fortinet FortiWeb Actively Exploited - Bitsight
The Hacker News
Press · 14 Nov 2025, 08:00 · Now-Patched Fortinet FortiWeb Flaw Exploited in Attacks to Create Admin Accounts - The Hacker News
Rapid7
Press · 13 Nov 2025, 08:00 · CVE-2025-64446: Critical Vulnerability in Fortinet FortiWeb Exploited in the Wild - Rapid7
Arctic Wolf
Press · 13 Nov 2025, 08:00 · CVE-2025-64446: Critical Fortinet FortiWeb Path Traversal Vulnerability Exploited to Create Administrative Accounts - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.8 · reality 8.9 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC142Python14 Nov 2025, 19:49
fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal71Python14 Nov 2025, 18:13
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.4; EPSS 91.1%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:44.473516+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
13 Nov 2025, 08:00
Added to the CISA KEV catalog
14 Nov 2025, 00:00
Published
14 Nov 2025, 15:50
Latest press mention
23 Oct 2026, 13:50
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar