---
id: 3856
title: "Fortinet FortiWeb Authentication Bypass – CVE-2025-64446"
cve: CVE-2025-64446
cvss: 9.8
severity: critical
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/fortinet-fortiweb-authentication-bypass-cve-2025-64446"
published_at: "2025-11-19 00:00"
tags: ["active-exploitation", "vulnerability-research", "authentication-bypass", "web-security", "scanner", "fortiweb", "cve-2025-64446", "cisa-kev"]
phying_url: "https://phying.com/item/3856"
lang: en
---

# Fortinet FortiWeb Authentication Bypass – CVE-2025-64446

## Summary

Bishop Fox confirms CVE-2025-64446: one HTTP POST with a path traversal and crafted header creates an admin account on vulnerable FortiWeb builds, giving device takeover; CISA KEV listed.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2025-64446
- **CVSS:** 9.8
- **Published:** 2025-11-19 00:00
- **Original:** https://bishopfox.com/blog/fortinet-fortiweb-authentication-bypass-cve-2025-64446
- **Phying News:** https://phying.com/item/3856