Now-Patched Fortinet Forti Web Flaw Exploited in Attacks to Create Admin Accounts
Summary: Attackers are exploiting an authentication bypass in Fortinet FortiWeb, patched in version 8.0.2, to create new administrator accounts as a persistence mechanism, with watchTowr reporting active, indiscriminate in-the-wild exploitation first detected early last month. Tracked as CVE-2025-64446 (CVSS 9.1), the flaw combines a path traversal bug with an authentication bypass via the CGIINFO HTTP request header, letting an unauthenticated attacker impersonate any user, including the built-in admin, by supplying fixed values such as username "admin" and profname "prof_admin".
Key Takeaway: CISA added the flaw to its KEV catalog with a November 21, 2025 remediation deadline for federal agencies, and watchTowr's CEO said appliances that remain unpatched are likely already compromised - so the question is whether an unauthorized admin account already exists on yours.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-64446
- Related
- ⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More Cyber Risks ·CVE-2025-64446: Fortinet Forti Web Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 14, 2025