DaystoPatch

FortinetExploited incident

FortiWeb GUI path confusion letting unauthenticated attackers run admin commands (fixed before public disclosure)

CVE-2025-64446Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 14 Nov 2025

  • Exploited before a fix
FixedFixed for every supported version 25 days after the first public report.
Embed this live clock

Response

Silence
39d
First public report to first vendor statementUnverified source
Exposure
17d
First public report to first fixUnverified source
Follow-through
25d
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    BleepingComputerCuratedQuote verified

    The attacks were first identified by threat intel firm Defused on October 6, which published a proof-of-concept exploit

    Defused's own social-media post (2025-10-06) could not be fetched; BleepingComputer (2025-11-14) and The Register report the date.

    Source
    BleepingComputer news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6cddc79c90d06ee0…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    The RegisterCuratedQuote verified6 Oct 2025

    The battering attempts against Fortinet's web application firewalls date back to October 6, when cyber deception firm Defused published a PoC on social media that one of their FortiWeb Manager honeypots caught.

    Quote verified against archived copy https://web.archive.org/web/20251114212354/https://www.theregister.com/2025/11/14/fortinet_active_exploit_cve_2025_64446/

    Source
    The Register news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c74f24b79eb78613…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet advisory FG-IR-25-910ClaimedQuote verified14 Nov 2025

    Path confusion vulnerability in GUI

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-25-910 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2dead2616fc33ab4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-64446)ClaimedQuote verified14 Nov 2025

    Fortinet FortiWeb Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2025-11-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-64446ClaimedQuote verified14 Nov 2025, 15:50 UTC

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b5adb450af2ddba7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Nov 2025, 16:32 UTC

    You can now share your thoughts on vulnerability CVE-2025-64446 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet15 Nov 2025, 09:46 UTC

    CISA adds CVE-2025-64446 to KEV: Fortinet FortiWeb flaw allows unauthenticated command execution via crafted HTTP/HTTPS requests. Patch ASAP. # Fortinet # CVE202564446 # KEV # CyberSec

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date only+39dUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-910CuratedQuote not checked yet

    2025-11-14: Initial publication

    Fortinet's first public acknowledgement, 39 days after exploitation was publicly reported and 17 days after the silent fix in 8.0.2.

    Source
    Fortinet PSIRT FG-IR-25-910 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date only+39d

    Fortinet PSIRT FG-IR-25-910 (Wayback snapshot 2025-11-14 19:17 UTC)CuratedQuote verified

    Disable HTTP or HTTPS for internet facing interfaces.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:209ec56ccf80452a…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+17dUnverified: no archived copy, quote not checked yet

    Help Net Security (about the CVE-2025-58034 fixes)CuratedQuote not checked yet

    These fixed versions were released between October 23 and 31, 2025, with no mention of either CVE-2025-58034 or CVE-2025-64446

    Inference (upper bound): one of FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12 and 7.0.12 was out on 2025-10-23. 8.0.2 came on 2025-10-28 (BleepingComputer), so the 2025-10-23 build is 7.6.6, 7.4.11, 7.2.12 or 7.0.12. Each of these is either a fixed build for this CVE (7.2.12, 7.0.12) or comes after one (7.6.5, 7.4.10), so a fixed build for this CVE was public by 2025-10-23. FortiWeb release notes have no change log, so the branch cannot be confirmed.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    BleepingComputerCuratedQuote verified28 Oct 2025

    which confirms that the zero-day has been patched in FortiWeb 8.0.2, released on October 28, three weeks after the first report of CVE-2025-64446 active exploitation.

    Silent fix: FortiWeb 8.0.2 shipped without any advisory or CVE. Rapid7 confirmed the public PoC fails on 8.0.2 (The Register). Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Source
    BleepingComputer news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6cddc79c90d06ee0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+25dUnverified: no archived copy, quote not checked yet

    Help Net Security (about the later CVE-2025-58034 fixes)CuratedQuote not checked yet

    These fixed versions were released between October 23 and 31, 2025, with no mention of either CVE-2025-58034 or CVE-2025-64446

    Inference (R6): CVE-2025-64446's fixes (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12) are equal to or older than CVE-2025-58034's (8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12), all of which were out by 2025-10-31, so every branch was fixed for this CVE by then (upper bound).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-910 (Wayback snapshot 2025-11-14 19:17 UTC)CuratedQuote verified14 Nov 2025

    Upgrade to 7.0.12 or above

    The first-day advisory lists released fixes for every affected branch (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12) with none marked 'upcoming'. Release dates of 7.6.5/7.4.10/7.2.12/7.0.12 were not found, so this is the date all fixes were confirmed available (they may have shipped earlier).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:209ec56ccf80452a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

This advisory changed after publication

  1. FG-IR-25-910

    Changed without a revision note

    Path confusion vulnerability in GUI

    CVSS exploit maturity changed from functional to high (displayed score 9.1 to 9.4).

    • Severity
    CVSS exploit maturity
    Beforefunctional
    Afterhigh
    Earlier version captured 17 Nov 2025, 09:42 UTC: archived copyLater version captured 25 Nov 2025, 12:26 UTC: archived copyRecovered from archived copiesSnapshots 6ca5019f4f… and b555c40285…Incident page

Send this to your boss

FortiWeb admin-bypass flaw exploited from Oct 6; first fixed builds by Oct 23

Attackers used a FortiWeb path traversal bug to create admin accounts from early October 2025; fixed builds were released between 23 and 31 October, and Fortinet's advisory was published on 14 November.

In plain words

Fortinet's FortiWeb web application firewall had a critical flaw that let outsiders create administrator accounts, and attackers used it from early October 2025. Fixed versions came out between 23 and 31 October; Fortinet's advisory was published on 14 November. If we run FortiWeb, we need to be on a fixed version and check it for administrator accounts we did not create.

What happened and who is affected

What happened

From 6 October 2025 researchers at Defused reported attacks against FortiWeb web application firewalls using an unknown exploit that creates new administrator accounts without logging in. Fixed FortiWeb builds were released between 23 and 31 October 2025; FortiWeb 8.0.2 came out on 28 October. Fortinet published advisory FG-IR-25-910 (CVE-2025-64446, CVSS 9.8) on 14 November 2025, confirming exploitation and listing fixes for all supported branches and a workaround of disabling HTTP/HTTPS on internet-facing interfaces.

Who is affected

FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11 and 7.0.0-7.0.11. FortiWeb 6.4 and FortiAppSec Cloud are not affected.

CVE-2025-64446. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2025-64446/

Affected products

  • FortiWeb
How we built this timeline

Zero-day with a silent patch. Timeline: 6 Oct 2025 Defused publishes PoC from honeypot capture; 28 Oct 2025 FortiWeb 8.0.2 released (fix, no advisory); 13 Nov 2025/14 watchTowr and Rapid7 report indiscriminate exploitation and confirm 8.0.2 blocks it; 14 Nov 2025 Fortinet advisory and KEV.

The live advisory still says 'Known Exploited No' in its metadata while its summary says 'Fortinet has observed this to be exploited in the wild'. CVE-2025-58034 (FG-IR-25-513, 18 Nov 2025) is widely believed to chain with this bug, but Fortinet has not stated a joint campaign, so it is a separate incident.

Audit 2 (23 Oct 2026): First fix moved from 28 Oct 2025 to 23 Oct 2025 and Fixed for all versions from 14 Nov 2025 to 31 Oct 2025 (both upper bounds), inferred from Help Net Security's statement that the CVE-2025-58034 fixed builds (8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12) were 'released between October 23 and 31, 2025'; this CVE's fixed builds are the same or earlier. exploited before a fix stays true (exploitation from 6 Oct 2025).

Related

Fortinet report card