U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

Securityaffairs.Co •Pierluigi Paganini • November 15, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiWeb flaw, tracked as CVE-2025-64446 (CVSS score of 9.1), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a relative path traversal issue in Fortinet FortiWeb 8.0.0 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of total control being seized by malicious actors. The flaw has been confirmed to be exploited in the wild, prompting urgent attention from cybersecurity teams. 100 sources 80

Extracted Entities

CVEs (1)

CVE-2025-64446

Platforms (1)

Fortinet FortiWeb