Loading story…
A critical zero-day vulnerability in Fortinet's FortiWeb Web Application Firewall (WAF), tracked as CVE-2025-64446, has been actively exploited by threat actors since early October 2025. The flaw, which combines a path traversal and authentication bypass, allows attackers to create malicious administrative accounts and execute privileged actions on vulnerable FortiWeb devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply patches by November 21, 2025. The vulnerability affects multiple FortiWeb versions, including 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11, and is being exploited in the wild to gain unauthorized administrative access.
Security briefings and technical reports confirm that attackers are leveraging crafted HTTP or HTTPS requests to exploit the flaw, enabling them to bypass authentication and perform administrative actions. The exploitation campaign has prompted urgent patching advisories and highlights the ongoing risk posed by unpatched WAF appliances in enterprise environments. While the identity of the threat actors remains unknown, the rapid weaponization of this vulnerability underscores the importance of timely patch management and monitoring for suspicious administrative account creation on FortiWeb devices.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a malicious Visual Studio Code extension named 'susvsex' in the official marketplace. The extension was reported to include ransomware and data-stealing functionality.
A critical CVSS 9.8 vulnerability was disclosed in the widely used expr-eval JavaScript library. The package is commonly used in online calculators and natural-language-processing tools, increasing potential downstream exposure.
DANABOT was reported to have undergone a substantial code rewrite that improved its speed and stability. The update was described as occurring after earlier law-enforcement pressure from Operation Endgame.
Microsoft issued its November Patch Tuesday security updates, addressing 68 vulnerabilities, including one zero-day. The release was highlighted as a major defensive response to active and emerging threats.
A zero-day vulnerability in Fortinet FortiWeb, tracked as CVE-2025-64446, was disclosed as allowing attackers to create administrator accounts through crafted HTTP or HTTPS requests. Multiple FortiWeb versions were reported as affected.
Europol coordinated a new phase of Operation Endgame targeting major cybercrime services and malware families, including RHADAMANTHYS, VENOMRAT, and the ELYSIUM botnet. The action represented a fresh law-enforcement escalation against criminal infrastructure.
Law enforcement actions under Operation Endgame disrupted DANABOT operations, setting the stage for later malware redevelopment. Subsequent reporting says the malware's authors revised the codebase after these disruptions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, CVE-2025-64446, affecting Fortinet FortiWeb web application firewall devices has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, present in FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and earlier branches, allows unauthenticated remote attackers to bypass authentication and execute administrative commands via crafted HTTP or HTTPS requests. Attackers have leveraged this vulnerability to create unauthorized administrative accounts, such as "Testpoint" and "trader," enabling persistent and undetected access to affected systems. Fortinet has released patches in version 8.0.2 and equivalent updates, but exploitation continues against unpatched devices, exposing organizations to significant risk of compromise and data exposure. CISA's inclusion of CVE-2025-64446 in the KEV catalog underscores the urgency of remediation, especially for U.S. federal agencies, which have been mandated to patch vulnerable FortiWeb systems by November 21, 2025. The agency also strongly advises all organizations to prioritize remediation of this and other KEV-listed vulnerabilities to reduce exposure to active cyber threats. The vulnerability's exploitation highlights the ongoing risk posed by unpatched perimeter security devices and the importance of timely vulnerability management in defending against sophisticated attacks.
Jun 29, 2026
A critical authentication bypass vulnerability in Fortinet FortiWeb web application firewalls has been actively exploited in the wild, allowing unauthenticated attackers to create new administrator accounts and fully compromise affected devices. The flaw, which was silently patched in version 8.0.2, enables attackers to send crafted HTTP POST requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi`) to add privileged users. Security researchers from watchTowr, Defused, and Rapid7 have confirmed exploitation attempts since early October, with proof-of-concept exploits and detection tools now publicly available. The vulnerability has not yet been assigned a CVE, and Fortinet has not released an official advisory or comment as of the latest reports. Organizations running FortiWeb versions prior to 8.0.2 are urged to update immediately or restrict public access to the management interface. Security teams should check for unauthorized admin accounts and investigate for potential compromise if their systems have been exposed since early October. The identity of the threat actors remains unknown, but the attacks are widespread and indiscriminate, targeting internet-facing FortiWeb devices. Researchers have published indicators of compromise and recommended urgent mitigation steps to prevent further exploitation.
Jun 29, 2026
A critical path traversal vulnerability in Fortinet FortiWeb, tracked as CVE-2025-64446, is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute administrative commands on affected FortiWeb appliances by abusing the management API to reach internal endpoints. GreyNoise observed weaponization of this vulnerability within 72 hours of its disclosure, with coordinated scanning activity originating from multiple IPs and hosting providers, indicating a rapid and organized exploitation effort. The vulnerability affects FortiWeb versions 7.0 through 8.0, and exploit attempts have been detected using uniform TLS fingerprints, suggesting the use of automated tools. CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch the flaw within a specified deadline. Another FortiWeb zero-day, CVE-2025-58034, was also disclosed and patched, but CVE-2025-64446 is noted as the more critical issue due to its unauthenticated attack vector and higher CVSS score. Security researchers emphasize the urgency of patching FortiWeb appliances to prevent unauthorized access and potential compromise, as exploitation is ongoing and targeting a broad range of organizations.
Jun 29, 2026