Testing another post

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec sodales nisi quis elit tristique efficitur. Curabitur elementum ultrices commodo. Proin at semper augue. Vestibulum nec porta lorem, placerat porta risus. Proin pharetra metus a suscipit rhoncus. Duis gravida urna tortor, quis venenatis nisl euismod eu. Pellentesque varius enim non purus laoreet dignissim. Donec eu vehicula ex, eu mattis nisl. Orci varius natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Pellentesque ultricies pharetra metus, nec placerat lectus dapibus sed. In molestie, felis vitae vulputate fermentum, libero justo vulputate sem, ornare vestibulum sapien velit et purus. Quisque velit massa, fermentum vel risus faucibus, tincidunt volutpat turpis

Welcome to The researcher’s desk  – a content series where the Detectify security research team conducts a technical autopsy on vulnerabilities that are particularly interesting, complex, or persistent. For this issue, we look at CVE-2025-64446, a critical authentication bypass that has been actively exploited in the wild, targeting Fortinet’s Web Application Firewall (WAF) product, FortiWeb.

The Case File: Unauthenticated control

Vulnerability Type	Authentication Bypass / Impersonation Flaw
Disclosure Date	November 14, 2025
Score	9.8 (Critical)
Vector	CVSS:3.1/AV:N/AC:L/PR:N­/UI:N/S:U/C:H/I:H/A:H
Identifier	CVE-2025-64446
Vulnerable Component	Fortinet FortiWeb (Web Application Firewall)
Final Impact	Unauthenticated execution of administrative commands / complete control.
Observations	Exploited in the wild; involved a “silent patch.”

What’s the root cause of CVE-2025-64446?

The core issue is a complex Unauthenticated Authentication Bypass flaw. It involves an improper handling mechanism within the FortiWeb appliance that is related to user impersonation functionality.

Essentially, the vulnerability allows an attacker to manipulate the way the system validates user identity, tricking the appliance into granting administrative privileges. The flaw is rooted in how a function intended to handle user context is improperly exposed or protected, enabling its misuse for unauthorized access.