Cyber Centre warns of exploited Fortinet FortiWeb flaw that grants admin control

The Canadian Centre for Cyber Security issued an alert on Nov. 14, 2025, urging organizations to patch Fortinet FortiWeb web application firewalls against a critical flaw that attackers were already exploiting. The bug, tracked as CVE-2025-64446, can give an unauthenticated attacker administrative control of the device.

FortiWeb sits in front of public websites and applications to filter malicious traffic, so a compromised unit hands an intruder a trusted position at the network edge. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue the same day.

What happened

According to Fortinet's advisory FG-IR-25-910, CVE-2025-64446 is a relative path traversal weakness in FortiWeb's graphical interface. An attacker can send crafted HTTP or HTTPS requests to run administrative commands on the system. Fortinet rated it 9.8 out of 10 on the CVSS scale.

The Cyber Centre's alert AL25-017 said it became aware of the issue on Nov. 13 and had seen open-source reporting that the flaw was being exploited in the wild. The Cyber Centre had also published a companion advisory, AV25-758.

Affected releases span every supported FortiWeb branch: 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11 and 7.0.0 through 7.0.11.

Days later, CISA also added a second FortiWeb flaw, an OS command injection bug tracked as CVE-2025-58034, to its exploited list on Nov. 18, a sign that the product was drawing sustained attention from attackers.

Web application firewalls are a frequent target because they must accept connections from anyone on the internet. When the management interface is reachable from outside, a flaw like this one requires no stolen password and no help from a user.

What we don't know yet

Neither Fortinet nor the Cyber Centre has said how many devices were compromised or who was behind the attacks. The Cyber Centre did not report any specific Canadian victims.

What to do

• Upgrade to FortiWeb 8.0.2, 7.6.5, 7.4.10, 7.2.12 or 7.0.12, or later releases on each branch.
• If you cannot upgrade right away, disable HTTP or HTTPS on internet-facing interfaces, as Fortinet recommends, until the patch is in place.
• After upgrading, review configurations and logs for unexpected changes, especially new administrator accounts you did not create.
• Report suspicious activity to the Cyber Centre through My Cyber Portal or [email protected].