Picus Security Analyzes FortiWeb Vulnerability Enabling Remote Code Execution

Cybersecurity firm Picus Security has published an analysis of the critical FortiWeb CVE-2025-64446 vulnerability, which allows for remote code execution and necessitates urgent action.

The vulnerability, detailed in a Fortinet security advisory dated November 14, 2025, affects multiple versions of FortiWeb web application firewalls (WAF). According to Picus Security, the issue stems from improper request routing and authentication logic, enabling unauthenticated attackers to execute commands with administrative privileges.

With a CVSS score of 9.8, the vulnerability is rated critical. Both the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet have confirmed that the flaw is being actively exploited in the wild. Organizations running vulnerable FortiWeb appliances are strongly advised to apply patches or implement mitigations without delay.

Picus Security's analysis outlines how the exploit chains two weaknesses: a relative path traversal that bypasses normal API handling, and a improperly processed HTTP header that allows for the impersonation of an administrator role without authentication. This combination grants attackers full administrative command execution capabilities.

The firm also offers tools to simulate the vulnerability and test existing security controls. The Picus Security Platform allows organizations to test their defenses and gain actionable mitigation insights.