Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The best part about my job is that I sometimes get to make some controversial statements. Well, as controversial as things can be in a niche area of cybersecurity like “what is a reasonable measure of vulnerability risk?” Along with my colleague Sander Vinberg we got to explore this question earlier this year at the second Annual VulnCon conference in Raleigh. Even though it’s only been held twice, it is quickly becoming one of my favorite conferences.

SNMP has always been one of the quiet but crucial components of network management. It helps administrators monitor devices, automate configurations, and keep operations running smoothly. On Sept. 24, 2025, Cisco disclosed a high-severity vulnerability, identified as CVE-2025-20352, affecting the SNMP implementation in its IOS and IOS XE software. This issue allows attackers with valid SNMP credentials to cause a denial of service or execute arbitrary code on the affected devices.

Welcome to The researcher’s desk – a content series where the Detectify security research team conducts a technical autopsy on vulnerabilities that are particularly interesting, complex, or persistent. For this issue, we look at CVE-2025-64446, a critical authentication bypass that has been actively exploited in the wild, targeting Fortinet’s Web Application Firewall (WAF) product, FortiWeb.

Welcome to The researcher’s desk – a content series where the Detectify security research team conducts a technical autopsy on vulnerabilities that are particularly interesting, complex, or persistent. The goal here is not to report the latest research (for which you can refer to the Detectify release log); it is to take a closer look at certain vulnerabilities, regardless of their disclosure date, that still offer critical lessons.

A critical zero-day, CVE-2025-64446, path-traversal vulnerability in Fortinet FortiWeb, the company’s Web Application Firewall (WAF), is being actively exploited in the wild to create unauthorized administrator accounts on exposed systems. This flaw allows unauthenticated attackers to gain complete administrator access to affected devices.

On November 13, 2025, open source reporting began detailing active exploitation of a silently patched Fortinet FortiWeb vulnerability. The flaw is a path traversal issue in the FortiWeb web application firewall (WAF) that allows an unauthenticated threat actor to create new administrative users on exposed devices. The following day, November 14, Fortinet officially addressed the vulnerability in an advisory, tracking it as CVE‑2025‑64446.