Loading vulnerability…
Forged Cookie Arbitrary Operations in Fortinet FortiWeb
CVE-2025-64447 is a high-severity vulnerability in Fortinet FortiWeb caused by reliance on cookies without adequate validation and integrity checking. It affects FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. An unauthenticated remote attacker who knows the target FortiWeb serial number can send crafted HTTP or HTTPS requests containing forged cookies and cause the appliance to perform arbitrary operations on the system. The flaw stems from trusting client-supplied cookie data without sufficient integrity protection or server-side validation, enabling manipulation of application state and privileged operations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operations on the affected FortiWeb system. Depending on the reachable functionality exposed through the forged cookie workflow, this can result in unauthorized administrative actions, security control bypass, configuration manipulation, and compromise of the integrity of the appliance. The issue is remotely exploitable over HTTP or HTTPS and does not require user interaction.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the FortiWeb management or affected web interfaces to untrusted networks, restrict access to trusted administrative sources, and monitor for anomalous crafted HTTP or HTTPS requests indicative of cookie forgery attempts. Additional defensive measures include enforcing stronger server-side validation of session state where configurable, reviewing session-management settings, and limiting disclosure of device-identifying information such as the FortiWeb serial number, since prior knowledge of that value is a stated exploitation prerequisite.
Patch, then assume compromise.
Upgrade FortiWeb to a vendor-fixed release. Affected versions are 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; organizations should move to the corresponding patched version provided by Fortinet for each supported branch. Apply the Fortinet PSIRT guidance for this issue and verify that cookie handling and session validation behavior reflect the vendor fix after upgrade.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.