Critical Fortinet FortiWeb WAF Bug Exploited in the Wild

A critical pre-authentication remote code execution vulnerability (CVE-2025-64446) in Fortinet FortiWeb has been actively exploited in the wild; the flaw is a relative path traversal that allows attackers to bypass authentication and execute privileged API commands. Fortinet published patched versions and mitigation guidance (including disabling HTTP/HTTPS on Internet-facing interfaces), the vulnerability carries a CVSS of 9.1 and has been added to CISA's KEV catalog, and security researchers have raised concerns about apparent silent patching and prior detection by external researchers.