Fortinet FortiWeb Vulnerability (CVE-2025-64446) Exploited in the Wild for Full Admin Takeover

Researchers and vendors have documented active exploitation of a critical FortiWeb path-traversal and authentication-bypass vulnerability (CVE-2025-64446) that enables unauthenticated attackers to invoke the fwbcgi handler and create persistent admin accounts; attacks have been observed in the wild since October 2025, the flaw scores CVSSv3.1 9.1, affects many FortiWeb versions (including EOL releases), and has prompted CISA KEV listing and vendor patches and mitigations.