Skip to main content

CISA issues alert on Fortinet FortiWeb relative path traversal vulnerability

Source Decision Insights Threat Desk Published November 21, 2025 Companies 2
Human View Machine View

2 companies named across 2 categories, one of 34 articles referencing Fortinet. Previous coverage: CISA adds one known exploited vulnerability to catalog (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Fortinet's FortiWeb Web Application Firewall (WAF) product includes a vulnerability that can permit unauthorized administrative command execution. This vulnerability affects multiple FortiWeb versions and arises from a relative path traversal issue exploitable through specific Hypertext Transfer Protocol (HTTP) or HTTPS requests.

The identified vulnerability, tracked as CVE-2025-64446, impacts FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. This relative path traversal (CWE-23) can be triggered by an unauthenticated attacker issuing specially crafted requests via HTTP or HTTPS. The vulnerability permits execution of administrative commands on compromised systems through this attack vector.

The consequences of this vulnerability include unauthorized administrative control over affected FortiWeb devices, which may involve execution of system-level commands without authentication.

Fortinet has provided fixed versions to address this issue: upgrade 8.0.0 through 8.0.1 to version 8.0.2 or later; 7.6.0 through 7.6.4 to 7.6.5 or later; 7.4.0 through 7.4.9 to 7.4.10 or later; 7.2.0 through 7.2.11 to 7.2.12 or later; and 7.0.0 through 7.0.11 to 7.0.12 or later. If immediate upgrading is not possible, disabling HTTP and HTTPS services on internet-facing interfaces is recommended, though this measure reduces but does not eliminate risk. Post-upgrade, configurations and logs should be reviewed for unauthorized changes or administrative account activity.

CISA has incorporated CVE-2025-64446 into its Known Exploited Vulnerabilities (KEV) Catalog as of November 14, 2025. Organizations are advised to follow published vendor remediation guidelines and monitor their systems for anomalous behaviors related to this vulnerability.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-fortinet-fortiweb-relative-path-traversal-vulnerability/",
        "name": "CISA issues alert on Fortinet FortiWeb relative path traversal vulnerability",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-fortinet-fortiweb-relative-path-traversal-vulnerability/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/fortinet/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/fortinet/",
      "name": "Fortinet"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:39:32-06:00",
    "datePublished": "2025-11-21T16:45:32-07:00",
    "description": "CISA reports CVE-2025-64446 in Fortinet FortiWeb permits unauthorized command execution via crafted HTTP/HTTPS requests; upgrades address the issue.",
    "headline": "CISA issues alert on Fortinet FortiWeb relative path traversal vulnerability",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/11/14/fortinet-releases-security-advisory-relative-path-traversal-vulnerability-affecting-fortiweb"
    },
    "keywords": [
      "Known Exploited Vulnerabilities",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-fortinet-fortiweb-relative-path-traversal-vulnerability/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/fortinet/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/fortinet/",
        "name": "Fortinet"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages