Exploited vulnerabilitiesBriefPublic record
FortiWeb path traversal plus command injection (CVE-2025-64446 / -58034)
KEV: 14 Nov 2025 and 18 Nov 2025. Exploited silently before disclosure.
- Disclosed
Live scores
Live scores
CVE-2025-58034- EPSS
- 0.547
very likely to be attacked soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Yes, since 2025-11-18
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-64446- EPSS
- 0.911
very likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2025-11-14
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.