FortiWeb path traversal enables unauthenticated RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unpatched FortiWeb versions allow unauthenticated attackers to execute admin commands via HTTP/HTTPS requests; actively exploited.
Fortinet's FortiWeb web application firewall contains a relative path traversal vulnerability (CVE-2025-64446) that permits unauthenticated attackers to execute administrative commands on affected systems through specially crafted HTTP or HTTPS requests. The vulnerability affects FortiWeb versions 8.0.0–8.0.1, 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.0–7.2.11, and 7.0.0–7.0.11. Fortinet has confirmed active in-the-wild exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities Catalog, indicating this is a genuine operational threat requiring immediate action.
Successful exploitation grants attackers administrative-level command execution on the FortiWeb appliance itself. The attack requires no authentication and relies only on network access to the HTTP or HTTPS management interface. Organizations following network security best practice by restricting the management interface to internal networks only reduce exposure, but any organization with internet-facing or untrusted-network access to the management plane is at immediate risk. Defenders should prioritize patching over all other work and verify that management interfaces are not externally accessible.
Mentioned in this report
Detection guidance
Path Traversal Sequences in Request to Web Management Interface with Successful Response
Detects ../ or encoded traversal sequences in the URI path or query that return HTTP 2xx, the request pattern used against relative path traversal flaws such as CVE-2025-64446 in FortiWeb. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequences in Request to Web Management Interface with Successful
Response
id: 2743ef5a-e7d0-50bf-89d1-244fd8949e89
status: experimental
description: Detects relative path traversal sequences (plain, URL-encoded or double-encoded)
in the URI of web requests that receive a successful 2xx response. This is the request
pattern used to exploit unauthenticated relative path traversal flaws in management
interfaces such as FortiWeb CVE-2025-64446. Best applied to logs from the appliance,
a reverse proxy or a WAF in front of management interfaces.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-stem|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- '%2e%2e/'
- ..%5c
- '%252e%252e'
selection_traversal_query:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- '%2e%2e/'
- ..%5c
- '%252e%252e'
selection_status:
sc-status:
- 200
- 201
- 202
- 204
condition: 1 of selection_traversal* and selection_status
falsepositives:
- Vulnerability scanners or penetration tests run against the management interface
- Poorly written web applications that legitimately pass relative paths in query parameters
level: medium
author: Vorant
Path Traversal Sequences in HTTP Request Through Proxy
Detects traversal sequences in request URIs seen in proxy or WAF logs that may indicate exploitation of path traversal RCE flaws in public-facing management interfaces such as FortiWeb. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequences in HTTP Request Through Proxy
id: f116058c-b862-5870-9c24-657dd2a0f5f8
status: experimental
description: Detects relative path traversal sequences in the URI of HTTP or HTTPS
requests visible in proxy or reverse-proxy logs, indicating possible exploitation
of unauthenticated path traversal flaws in public-facing appliance management interfaces
such as FortiWeb CVE-2025-64446. Requires logging of the full requested URI.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /../
- ..%2f
- '%2e%2e%2f'
- '%2e%2e/'
- ..%5c
- '%252e%252e'
selection_method:
cs-method:
- POST
- PUT
- GET
condition: selection and selection_method
falsepositives:
- Security scanners and red-team exercises testing for path traversal
- Web applications that embed relative paths in URL parameters
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-remote-code-execution_2025-107
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs