CVE-2025-64447

8.1 highEPSS 8.4%

High (8.1) in fortinet fortiweb. EPSS 8.4% chance of exploitation in the next 30 days.

A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 8.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-565
Published: 2025-12-09
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiweb

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-945

Check your stack JSON