CVE-2025-64447

—

CVSS 3.1

8.1 high

EPSS

8%p95

Published

Dec 9, 2025 (Dec 9, 2025)

Modified

Jun 17, 2026

Description

A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.

Vendors: fortinet
Products: fortiweb
Weakness: CWE-565
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.4%)

In the news0 stories

No ingested article mentions this CVE yet.