Fortinet finally cops to critical bug under active exploit

"We are aware of this vulnerability and activated our PSIRT response and remediation efforts as soon as we learned of this matter, and those efforts remain ongoing. Fortinet diligently balances our commitment to the security of our customers and our culture of responsible transparency. With that goal and principle top of mind, we are communicating directly with affected customers to advise on any necessary recommended actions. We urge our customers to refer to the advisory and follow the guidance provided for CVE FG-IR-25-910."

"The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet's FortiWeb product,"

"observed this to be exploited in the wild."

Fortinet's FortiWeb contains a critical path traversal vulnerability tracked as CVE-2025-64446 that enables unauthenticated attackers to execute administrative commands and fully compromise devices. The flaw is patched in FortiWeb version 8.0.2. Fortinet reported having observed exploitation in the wild and activated PSIRT response and remediation efforts while communicating directly with affected customers and urging them to follow advisory guidance for CVE FG-IR-25-910. A proof-of-concept exploit circulated since early October, and third-party researchers report widespread exploitation. The US CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities Catalog. Fortinet declined to disclose attack scope or precise timeline.

Read at Theregister