CVE-2025-64446: FortiWeb Zero-Day Under Active Exploitation

FortiWeb 0-day under active exploitation

The CrowdSec Network has detected active exploitation of CVE-2025-64446, a path-traversal vulnerability in Fortinet FortiWeb. CVE-2025-64446 allows attackers to invoke system endpoints and bypass authentication for FortiWeb. The vulnerability has been given a high severity rating and has been circulating as a 0-day exploit since October 2025. The vulnerability affects FortiWeb versions before 8.0.1. CrowdSec Intelligence has detected around 60 distinct IPs probing for this vulnerability.

CrowdSec’s key findings on CVE-2025-64446

The vulnerability was disclosed on November 14, 2025, by WatchTowr Labs and added to CISA KEV the same day.
CrowdSec coverage and telemetry indicate exploitation attempts starting on November 12, 2025, at least two days before the public disclosure. CrowdSec released a virtual patching rule for the CrowdSec WAF on November 17.
Fortinet silently patched the vulnerability with FortiWeb 8.0.2

The full report with details about the CVE and our trend analysis can be found on our website. You can check it out here: https://www.crowdsec.net/vulntracking-report/cve-2025-64446
How does CVE-2025-64446 work?

watchTowr details how CVE-2025-64446 can be abused to impersonate users, effectively bypassing normal authentication checks in certain workflows. The exploit works in two steps. First, the path traversal vulnerability is used to access a system binary in the FortiWeb application. The request body is then passed to this binary, allowing attackers to manipulate or create authenticated users. In practice, this can allow an attacker to assume another user’s identity, leading to unauthorized access and policy manipulation.