Decision Insights Threat Desk

CISA reported exploitation of CVE-2025-64446, a relative path traversal vulnerability in Fortinet FortiWeb versions between 7.0.0 and 8.0.1. The flaw allows unauthenticated actors to execute administrative commands via crafted HTTP(S) requests. Fortinet advises upgrading to specified fixed versions or disabling HTTP/HTTPS for external interfaces.

Fortinet's FortiWeb versions have a relative path traversal flaw allowing unauthorized admin command execution via HTTP/HTTPS requests.

CISA has added CVE-2025-61757 impacting Oracle Fusion Middleware to the Known Exploited Vulnerabilities Catalog.

CISA adds CVE-2025-61757 affecting Oracle Fusion Middleware to Known Exploited Vulnerabilities Catalog following active exploits.

CISA added CVE-2025-64446, a Fortinet FortiWeb path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence. Federal agencies must remediate under BOD 22-01; CISA recommends all organizations prioritize mitigation of listed vulnerabilities in vulnerability management.

CISA added CVE-2025-64446, a Fortinet FortiWeb path traversal vulnerability, to its vulnerability catalog after detecting active exploitation.