CVE-2025-64446FortiWeb auth bypass and path traversal, admin creation
What broke
FortiWeb had an authentication bypass combined with path traversal that let an unauthenticated attacker create an administrative user. CVSS 9.8. CISA added it to KEV around 14 November 2025.
Why it matters
This is not a SAML bug. It is a management-plane auth bypass on the same product family that later failed FortiCloud SSO. Two independent ways to become admin on a WAF, both exploited, both on KEV, is a pattern: the identity of the appliance is the target, not a single protocol.
What to do
- Patch FortiWeb for CVE-2025-64446 and then take the SSO fixes (CVE-2025-59719, CVE-2026-24858).
- Hunt for admin accounts that were not created by your change process, especially from mid-November 2025.
- Take FortiWeb management off the internet. Put it behind a jump path with phishing-resistant MFA.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2025-64446
- CISA KEV (added ~14 November 2025)
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- k0t access broker breaks into edge devices and harvests directory credentials 2026 · Identity infrastructure vulnerability
- FortiWeb authentication bypass exploited to create rogue admin accounts 2025 · Identity infrastructure vulnerability
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a