FortiWeb Path Traversal Vulnerability CVE-2025-64446

Historical catalog analysis: CISA added this entry on November 14, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-64446 is a relative path traversal vulnerability (CWE-23) identified in Fortinet FortiWeb. This flaw may allow an unauthenticated attacker to execute administrative commands on the system by sending specially crafted HTTP or HTTPS requests. Because Web Application Firewalls (WAFs) are often positioned at the perimeter of a network, a vulnerability allowing unauthorized administrative access to the device itself represents a significant security risk.

Exposure and applicability

This vulnerability is applicable to healthcare organizations utilizing FortiWeb to protect web-facing assets, such as patient portals, scheduling systems, or electronic protected health information (ePHI) exchange gateways. If an attacker successfully executes administrative commands on the WAF, they could potentially alter security policies, bypass traffic filtering, or gain further insight into the internal network architecture.

Healthcare IT and clinical engineering teams should refer to the vendor’s PSIRT advisory (FG-IR-25-910) to determine if their specific version of FortiWeb is affected. While CISA has added this to its Known Exploited Vulnerabilities catalog, it is not currently confirmed whether this vulnerability has been utilized in ransomware campaigns.

Remediation priorities

Our analysis suggests the following prioritized actions for healthcare security leaders:

1. Immediate Version Audit: Identify all FortiWeb deployments and verify their current firmware versions against the vendor’s affected list. This is a prerequisite for any remediation effort.
2. Apply Vendor Mitigations: Prioritize the application of patches or mitigations as specified in the FG-IR-25-910 advisory. Given that this vulnerability allows unauthenticated administrative access, updating the perimeter device should be treated as a high-priority task to maintain the integrity of the ePHI environment.
3. Review Administrative Access Logs: Examine logs for unusual HTTP/HTTPS requests or unauthorized administrative changes that may have occurred prior to patching. This helps in identifying if the vulnerability was targeted before the update.

How to validate remediation

To verify that exposure has been reduced, administrators should:
* Confirm Version Update: Verify through the system dashboard or command line that the firmware version is updated to a non-vulnerable release as defined by Fortinet.
* Audit Configuration Integrity: Review administrative settings and access control lists (ACLs) to ensure no unauthorized accounts or policy changes were introduced while the system was vulnerable.

Note: We do not recommend performing intrusive penetration testing or sending crafted requests against production medical infrastructure; validation should rely on version verification and log analysis in coordination with vendor guidance.

Limits and open questions

Updating the software could reduce the likelihood of exploitation, but it does not guarantee absolute prevention of all future path traversal variants. A primary limitation is that if an attacker already gained persistence through this vulnerability prior to patching, a firmware update alone may not remove the intruder. Organizations should consider whether their current logging levels are sufficient to detect the specific crafted requests associated with CVE-2025-64446.

Source and editorial note

CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability · Source date: November 14, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 17, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 26, 2026 at 02:17 UTC.

Request a healthcare security assessment