FortiWeb authentication bypass exploited to create rogue admin accounts
Fortinet confirmed on November 14, 2025 that CVE-2025-64446, a path traversal and authentication bypass in FortiWeb, was being exploited in the wild; CISA added it to its Known Exploited Vulnerabilities catalog the same day. Researchers had seen exploitation since early October 2025, with automated requests creating new local administrator accounts on exposed appliances.
- Victim
- Multiple: internet-exposed Fortinet FortiWeb appliances
- Industry
- Technology
- Country
- Global
- Intrusion began
- Oct 2025
- First disclosed
- Nov 14, 2025
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The management plane trusted a crafted request in place of a login. Keeping admin interfaces off the internet and alerting on any new local administrator account are the controls that catch this class of bug.
Go deeper on SWI
- Vulnerability: FortiWeb auth bypass and path traversal, admin creation
Sources
- Fortinet finally cops to critical bug under active exploit, The Register, Nov 14, 2025
- Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability, SecurityWeek, Nov 14, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). FortiWeb authentication bypass exploited to create rogue admin accounts. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-fortiweb-cve-2025-64446-admin-creation/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.