{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiWeb versions 7.6.x ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.2.x ant\u00e9rieures \u00e0 7.2.12",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 8.0.x ant\u00e9rieures \u00e0 8.0.2",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.4.x ant\u00e9rieures \u00e0 7.4.10",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-64446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-64446"
    }
  ],
  "initial_release_date": "2025-11-14T00:00:00",
  "last_revision_date": "2025-11-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1014",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Fortinet FortiWeb. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n\nFortinet indique que la vuln\u00e9rabilit\u00e9 CVE-2025-64446 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Fortinet FortiWeb",
  "vendor_advisories": [
    {
      "published_at": "2025-11-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-25-910",
      "url": "https://www.fortiguard.com/psirt/FG-IR-25-910"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FortiWeb ist eine Web Application Firewall von Fortinet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiWeb ausnutzen, um Administratorrechte zu erlangen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2603 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2603.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2603 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2603"
      },
      {
        "category": "external",
        "summary": "Rapid7 Blog vom 2025-11-13",
        "url": "https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/"
      },
      {
        "category": "external",
        "summary": "Fortiguard PSIRT Advisory FG-IR-25-910 vom 2025-11-14",
        "url": "https://www.fortiguard.com/psirt/FG-IR-25-910"
      }
    ],
    "source_lang": "en-US",
    "title": "Fortinet FortiWeb: Schwachstelle erm\u00f6glicht Erlangen von Administratorrechten",
    "tracking": {
      "current_release_date": "2025-11-16T23:00:00.000+00:00",
      "generator": {
        "date": "2025-11-17T05:22:21.881+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2603",
      "initial_release_date": "2025-11-13T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-11-13T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-11-16T23:00:00.000+00:00",
          "number": "2",
          "summary": "Updates von Fortinet aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.6.5",
                "product": {
                  "name": "Fortinet FortiWeb \u003c7.6.5",
                  "product_id": "T046841"
                }
              },
              {
                "category": "product_version",
                "name": "7.6.5",
                "product": {
                  "name": "Fortinet FortiWeb 7.6.5",
                  "product_id": "T046841-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiweb:7.6.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.12",
                "product": {
                  "name": "Fortinet FortiWeb \u003c7.2.12",
                  "product_id": "T046842"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.12",
                "product": {
                  "name": "Fortinet FortiWeb 7.2.12",
                  "product_id": "T046842-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiweb:7.2.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.0.2",
                "product": {
                  "name": "Fortinet FortiWeb \u003c8.0.2",
                  "product_id": "T048618"
                }
              },
              {
                "category": "product_version",
                "name": "8.0.2",
                "product": {
                  "name": "Fortinet FortiWeb 8.0.2",
                  "product_id": "T048618-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiweb:8.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.4.10",
                "product": {
                  "name": "Fortinet FortiWeb \u003c7.4.10",
                  "product_id": "T048632"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.10",
                "product": {
                  "name": "Fortinet FortiWeb 7.4.10",
                  "product_id": "T048632-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiweb:7.4.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.12",
                "product": {
                  "name": "Fortinet FortiWeb \u003c7.0.12",
                  "product_id": "T048633"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.12",
                "product": {
                  "name": "Fortinet FortiWeb 7.0.12",
                  "product_id": "T048633-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiweb:7.0.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FortiWeb"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64446",
      "product_status": {
        "known_affected": [
          "T046842",
          "T048618",
          "T046841",
          "T048633",
          "T048632"
        ]
      },
      "release_date": "2025-11-13T23:00:00.000+00:00",
      "title": "CVE-2025-64446"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Fortinet heeft een kwetsbaarheid verholpen in FortiWeb.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Fortinet heeft een kwetsbaarheid verholpen in FortiWeb. De kwetsbaarheid met het kenmerk CVE-2025-64446 betreft een relative path traversal-kwetsbaarheid en stelt een niet-geauthenticeerde aanvaller op afstand in staat om administratieve commando\u2019s uit te voeren via speciaal vervaardigde HTTP-verzoeken.\n\nHet NCSC heeft informatie ontvangen dat de kwetsbaarheid al enige tijd actief wordt misbruikt. Tevens hebben onderzoekers Proof-of-Concept-code (PoC) gepubliceerd waarmee de kwetsbaarheid kan worden aangetoond. Het is daarom de verwachting dat het aantal pogingen tot misbruik verder zal toenemen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Fortinet heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie de bijgevoegde referenties voor meer informatie.\n\nAls het installeren van een update niet direct mogelijk is, adviseert Fortinet om HTTP en HTTPS uit te schakelen op internetgerichte interfaces. Fortinet raadt aan deze maatregel in stand te houden totdat de update kan worden uitgevoerd.\n\nWanneer de beheerinterface conform best practices uitsluitend intern benaderbaar is, wordt het risico aanzienlijk verminderd.\n\nControleer de FortiWeb-omgeving op indicatoren die door beveiligingsbedrijven zijn gedeeld. De kwetsbaarheid is namelijk al misbruikt voordat Fortinet de beveiligingsupdates uitbracht. Met name organisaties waarvan de beheerinterface via het internet toegankelijk is, lopen een verhoogd risico te zijn gecompromitteerd.\n\nControleer de FortiWeb-omgeving op aanwezigheid van de volgende indicatoren van beveiligingsbedrijf Qualys. Aanwezigheid kan duiden op misbruik van de kwetsbaarheid.\n\n- Binnenkomende POST-verzoeken naar */api/v2.0/cmd/system/admin%3F/../../../../../cgi-bin/fwbcgi* of soortgelijke path-traversalpatronen afkomstig van niet-geautoriseerde IP-adressen.\n- Verzoeken met base64-encoded CGINFO-headers.\n- Onbekende beheerdersaccounts die sinds begin oktober 2025 zijn aangemaakt.\n- Nieuwe lokale gebruikersaccounts met het toegangsprofiel prof_admin.\n- Accounts met trust host-ranges ingesteld op *0.0.0.0/0* of *::/0*.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Relative Path Traversal",
        "title": "CWE-23"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://blog.qualys.com/vulnerabilities-threat-research/2025/11/14/unauthenticated-authentication-bypass-in-fortinet-fortiweb-cve-2025-64446-exploited-in-the-wild"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-910"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Fortinet FortiWeb",
    "tracking": {
      "current_release_date": "2025-11-15T14:57:33.774388Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0366",
      "initial_release_date": "2025-11-15T14:57:33.774388Z",
      "revision_history": [
        {
          "date": "2025-11-15T14:57:33.774388Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiWeb"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Fortiweb"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Fortiweb (Application)"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64446",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "other",
          "text": "Relative Path Traversal",
          "title": "CWE-23"
        },
        {
          "category": "description",
          "text": "Fortinet FortiWeb has a relative path traversal vulnerability that allows unauthenticated attackers to execute administrative commands via specially crafted HTTP or HTTPS requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64446 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64446.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-64446"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-14T16:15:58Z",
    "severity": "CRITICAL"
  },
  "details": "A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.",
  "id": "GHSA-hp5v-vp9j-7vp9",
  "modified": "2025-11-19T15:31:33Z",
  "published": "2025-11-14T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-910"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-64446/8.0.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"
    },
    {
      "type": "WEB",
      "url": "https://www.patreon.com/posts/cve-2025-64446-8-143791801"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "cisaActionDue": "2025-11-21",
  "cisaExploitAdd": "2025-11-14",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Fortinet FortiWeb Path Traversal Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDE13E2A-CEC3-4FC7-98AD-11CA1EAEC0C0",
              "versionEndExcluding": "7.0.12",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "551127B2-DCE9-403D-8073-ACD717CD0B19",
              "versionEndExcluding": "7.2.12",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "83212B0A-5EEF-4FA7-89C5-5E4D687CBB07",
              "versionEndExcluding": "7.4.10",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D358CE92-A30D-4058-8D12-00376E4B9074",
              "versionEndExcluding": "7.6.5",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1DD8ABA-9BB5-4ED8-9E34-1CB0752651DF",
              "versionEndExcluding": "8.0.2",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests."
    }
  ],
  "id": "CVE-2025-64446",
  "lastModified": "2025-11-21T18:27:33.730",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-11-14T16:15:58.567",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-910"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}