Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild

### Executive Summary: A critical authentication bypass (CVE-2025-64446, CVSS 9.8) in Fortinet FortiWeb is being actively exploited since early October 2025; attackers chain a path traversal to reach the fwbcgi CGI and supply a base64-encoded CGIINFO header that impersonates the built-in admin to create persistent administrative accounts. The advisory lists affected FortiWeb versions, Qualys QIDs for detection, network- and host-based IOCs, and remediation guidance (upgrade to specified fixed versions or temporarily disable HTTP/HTTPS).