CVE-2025-64446 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet	CNA	9.4 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Vendor	Product	Version
fortinet	fortiweb	7.0.0 ≤ 𝑥 < 7.0.12
fortinet	fortiweb	7.2.0 ≤ 𝑥 < 7.2.12
fortinet	fortiweb	7.4.0 ≤ 𝑥 < 7.4.10
fortinet	fortiweb	7.6.0 ≤ 𝑥 < 7.6.5
fortinet	fortiweb	8.0.0 ≤ 𝑥 < 8.0.2

𝑥

= Vulnerable software versions

Known Exploits!

https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass

Common Weakness Enumeration

CWE-23 - Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Vulnerability Media Exposure

[ENGLISH] Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks
Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls. [...]
Published: 2025-12-29T06:16:03-05:00

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-910

https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446