Skip to main content

CISA adds Fortinet FortiWeb vulnerability to Known Exploited Vulnerabilities Catalog

Source Decision Insights Threat Desk Published November 21, 2025 Companies 3
Human View Machine View

3 companies named across 5 categories, one of 32 articles referencing Fortinet. Previous coverage: CISA Adds CVE-2025-58034 to Known Exploited Vulnerabilities Catalog (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog by including a newly identified vulnerability affecting Fortinet FortiWeb. This vulnerability involves path traversal, which has the potential to impact system security significantly.

The vulnerability is identified as CVE-2025-64446 and affects Fortinet FortiWeb devices. The issue arises from an exploitable path traversal flaw in the affected product. The catalog entry is based on confirmed active exploitation. No additional vulnerabilities are referenced alongside this one in the update.

Systems vulnerable to this flaw may be subject to unauthorized access or manipulation as a result of the path traversal condition. The advisory notes that this type of vulnerability is commonly exploited by malicious actors and poses risks to enterprise networks.

Currently, the advisory does not specify any fixes or patches associated with CVE-2025-64446. The vulnerability is recognized within the framework of the Binding Operational Directive (BOD) 22-01, which mandates remediation efforts for federal networks against identified threats.

Under BOD 22-01, federal civilian executive branch agencies are required to address vulnerabilities listed in the KEV Catalog by designated deadlines. While this directive directly applies to these agencies, CISA recommends that all organizations consider prioritizing remediation of vulnerabilities included in the catalog as part of their security management processes. Future catalog updates will continue to incorporate vulnerabilities that meet established criteria for known exploitation.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-adds-fortinet-fortiweb-vulnerability-to-known-exploited-vulnerabilities-catalog/",
        "name": "CISA adds Fortinet FortiWeb vulnerability to Known Exploited Vulnerabilities Catalog",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-adds-fortinet-fortiweb-vulnerability-to-known-exploited-vulnerabilities-catalog/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:14:38-06:00",
    "datePublished": "2025-11-21T11:40:24-07:00",
    "description": "CISA adds CVE-2025-64446, a Fortinet FortiWeb path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog following active exploitation reports.",
    "headline": "CISA adds Fortinet FortiWeb vulnerability to Known Exploited Vulnerabilities Catalog",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    "keywords": [
      "Binding Operational Directive",
      "Known Exploited Vulnerabilities",
      "Remediation",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-adds-fortinet-fortiweb-vulnerability-to-known-exploited-vulnerabilities-catalog/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/fortinet/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/fortinet/",
        "name": "Fortinet"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages