VULNERABILITY INTELLIGENCE

CVE-2025-64447

CVSS score8.1 HIGH
EPSS probability8.35%
CISA KEVNot currently listed
Published2025-12-09
Last modified2026-09-25
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.

Weakness classification

  • psirt@fortinet.com: CWE-565

Primary references