Skip to main content

CISA adds one known exploited vulnerability to catalog

Source Decision Insights Threat Desk Published November 21, 2025 Companies 3
Human View Machine View

3 companies named across 5 categories, one of 33 articles referencing Fortinet. Previous coverage: CISA adds Fortinet FortiWeb vulnerability to Known Exploited Vulnerabilities Catalog (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

CISA has included a new security flaw in its Known Exploited Vulnerabilities (KEV) Catalog affecting Fortinet FortiWeb. This vulnerability involves a path traversal issue and has been observed being exploited in the wild.

The vulnerability identified as CVE-2025-64446 impacts Fortinet's FortiWeb product. It exploits a path traversal weakness, permitting threat actors to access unauthorized file system locations. The vulnerability can be triggered through interactions with the affected components. The advisory specifies this issue distinctly as a path traversal vulnerability associated with FortiWeb and differentiates it from other vulnerabilities based on the Common Vulnerabilities and Exposures (CVE) identifier.

The exploitation of this vulnerability may expose federal systems to unauthorized access or manipulation, posing risks to operational security. The advisory notes that such vulnerabilities have been frequently targeted by adversaries.

The Binding Operational Directive (BOD) 22-01 mandates Federal Civilian Executive Branch agencies to remediate vulnerabilities cataloged in the KEV list. This directive establishes deadlines for addressing these security issues to protect federal networks. The directive's fact sheet offers detailed information on compliance requirements relating to CVE-2025-64446.

CISA encourages all organizations, beyond those covered by BOD 22-01, to prioritize addressing vulnerabilities listed in the KEV Catalog as part of ongoing vulnerability management processes. Additional vulnerabilities meeting the specified criteria will be added to the catalog in the future.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-adds-one-known-exploited-vulnerability-to-catalog-3/",
        "name": "CISA adds one known exploited vulnerability to catalog",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-adds-one-known-exploited-vulnerability-to-catalog-3/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:06:49-06:00",
    "datePublished": "2025-11-21T11:42:23-07:00",
    "description": "CISA added Fortinet FortiWeb path traversal vulnerability CVE-2025-64446 to its Known Exploited Vulnerabilities Catalog and advises remediation.",
    "headline": "CISA adds one known exploited vulnerability to catalog",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    "keywords": [
      "Binding Operational Directive",
      "Common Vulnerabilities and Exposures",
      "Known Exploited Vulnerabilities",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-adds-one-known-exploited-vulnerability-to-catalog-3/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/fortinet/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/fortinet/",
        "name": "Fortinet"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages