Fortinet’s Response to FortiWeb Zero-Day Exploits: A Silent Patch Confirmed

Fortinet Silently Patches Critical Zero-Day Vulnerability in FortiWeb

Fortinet recently addressed a critical zero-day vulnerability in its FortiWeb web application firewall that was being heavily exploited in the wild. The company quietly patched the flaw after reports surfaced of unauthenticated attackers taking advantage of an unknown path traversal flaw in early October to create new administrative users on publicly exposed devices.

Threat intelligence firm Defused first identified the attacks on October 6, revealing that an unidentified Fortinet exploit, possibly a variant of CVE-2022-40684, was used to send HTTP POST requests to the Fortinet endpoint to create local admin-level accounts.

On Thursday, security researchers from WatchTower Labs also demonstrated an exploit for the vulnerability and released a tool called the “FortiWeb Authentication Bypass Artifact Generator” to assist defenders in identifying vulnerable devices.

Rapid7, a cybersecurity firm, confirmed that the flaw impacts FortiWeb versions 8.0.1 and earlier, noting that the publicly available proof-of-concept exploit became ineffective after updating to version 8.0.2.

Fortinet recently disclosed that attackers are actively exploiting a path confusion vulnerability in FortiWeb’s GUI component, tracked as CVE-2025-64446, allowing unauthenticated attackers to execute administrative commands on unpatched systems through crafted HTTP or HTTPS requests.

The company confirmed the active exploitation of the zero-day in a security advisory on Friday, stating that the vulnerability had been patched in FortiWeb 8.0.2, released on October 28, three weeks after the initial report of CVE-2025-64446 exploitation.

Federal Agencies Urged to Patch Vulnerabilities

CISA included the CVE-2025-64446 path traversal flaw in its list of actively exploited vulnerabilities, instructing U.S. federal agencies to patch their systems by November 21. The cybersecurity agency emphasized the significant risks posed by such vulnerabilities to the federal enterprise.

Administrators who cannot immediately upgrade to FortiWeb 8.0.2 are advised to disable HTTP or HTTPS for all internet-facing management interfaces and restrict access to trusted networks.

Fortinet recommended that customers review their configurations and logs for unauthorized administrator accounts and other unexpected changes.

Despite reaching out to Fortinet for further details on the ongoing attacks, BleepingComputer has yet to receive a response.

In a previous incident in August, Fortinet addressed a critical command injection flaw (CVE-2025-25256) in its FortiSIEM security monitoring solution shortly after GreyNoise warned of a surge in brute-force attacks targeting Fortinet SSL VPNs.

As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are moving fast to keep these new services safe.

This free cheat sheet outlines 7 best practices you can start using today.

Download Now