This critical path traversal vulnerability in Fortinet FortiWeb is currently being actively exploited in the wild and enables unauthenticated remote code execution.

This is a relative path traversal vulnerability (CWE-23) that permits an unauthenticated attacker to manipulate file paths in requests to execute arbitrary administrative commands on the underlying system. The attack vector is strictly network-based, requiring no user interaction or prior authentication.

The vulnerability carries a CVSS score of 9.5, reflecting its critical severity and the potential for total system compromise. Successful exploitation grants an attacker full administrative control over the appliance, leading to potential data exfiltration, service disruption, and the ability to pivot into the internal network. Given the active exploitation status in the CISA KEV catalog, the risk of unauthorized access and operational impact is extremely high.

Immediate Action: Upgrade to FortiWeb version 8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12, or any subsequent release provided by Fortinet.

Proactive Monitoring: Review system logs for suspicious HTTP or HTTPS requests containing path traversal sequences (such as dot-dot-slash patterns) targeting administrative endpoints.

Compensating Controls: While patching is the only definitive fix, ensure that management interfaces are not exposed to the public internet and utilize network access control lists to restrict traffic to authorized management workstations.

Public Exploit Available: Yes, weaponized exploits exist, including modules in Metasploit and ExploitDB, alongside numerous public Proof-of-Concept repositories on GitHub.

Due to the critical nature of this vulnerability and confirmed active exploitation, organizations must prioritize patching all affected FortiWeb instances immediately. Failure to apply the vendor-supplied updates leaves the appliance fully exposed to remote administrative command execution by unauthenticated actors. If immediate patching is not possible, the device should be isolated from untrusted networks until the update can be verified and applied.