
- CVE-2025-64446 allows unauthenticated attackers to run admin commands on FortiWeb WAF systems
- Actively exploited in the wild; affects versions 7.0.0–8.0.1, patched in 8.0.2
- CISA added it to KEV; Fortinet urges immediate patching or disabling internet-facing HTTP/HTTPS interfaces
Fortinet has released a fix for a critical vulnerability in its FortiWeb web application firewall (WAF), and has urged customers to update immediately, as the flaw is being actively exploited in the wild.