Fortinet FortiWeb CVE-2025-64446 (path traversal + authentication bypass, exploited to create rogue admin accounts, CISA KEV): which FortiWeb versions are fixed and how do I check for compromise?

What it is: CVE-2025-64446 is a relative path traversal in FortiWeb's management web interface that also bypasses authentication, letting an unauthenticated attacker run administrative commands. It was exploited from October 2025, mostly to create new local administrator accounts on internet-exposed FortiWeb appliances, before Fortinet's advisory (FG-IR-25-910) in November 2025. CISA added it to the Known Exploited Vulnerabilities catalog. Am I affected: - FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11 and 7.0.0-7.0.11, especially with the HTTP/HTTPS management interface reachable from the internet. Check with get system status on the CLI or on the dashboard. Fix: 1. Upgrade to 8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or later. 2. Until upgraded: disable HTTP/HTTPS administrative access on internet-facing interfaces, and limit management access to trusted hosts or a management network. After (do this even if you've now patched): - Review the list of administrator accounts and remove any you don't recognize; reported attacks created new admins with innocuous-looking names. - Check system event logs since October 2025 for administrative changes, configuration changes and logins you can't account for. - If you find unauthorized accounts or changes, treat the appliance as compromised: follow Fortinet's guidance, restore a known-good configuration, change all admin passwords, and review what the WAF protects for follow-on activity. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-25-910 https://www.securityweek.com/fortinet-confirms-active-exploitation-of-critical-fortiweb-vulnerability/ https://arcticwolf.com/resources/blog/cve-2025-64446/