The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive giving Federal Civilian Executive Branch (FCEB) agencies only seven (7) days to patch a critical vulnerability in Fortinet’s FortiWeb web application firewall that is under active exploitation worldwide. The flaw, tracked as CVE-2025-64446 (CVSS 9.1/10) combines a path traversal and authentication bypass, allowing unauthenticated attackers to execute administrative commands and create new administrator accounts for persistent access. Affecting FortiWeb versions 7.0.0 through 8.0.1, the issue was quietly resolved in versions 7.0.12, 7.2.12, 7.4.10, 7.6.5, and 8.0.2, though Fortinet did not disclose the fix in release notes. Researchers from Defused, watchTowr, Rapid7, and PwnDefend reported global, indiscriminate exploitation since early October, with exploit code and a zero-day allegedly offered for sale on dark web forums. Rapid7 and Tenable observed hundreds of vulnerable U.S. systems exposed on Shodan. Following reports of widespread compromise, CISA added the bug to its Known Exploited Vulnerabilities catalog, mandating rapid patching or disabling of HTTP/HTTPS interfaces until updates are applied. Fortinet has confirmed exploitation but declined to specify when it learned of the issue, urging customers to upgrade immediately and review logs for unauthorized administrative accounts, as this marks the 21st Fortinet flaw on CISA’s exploited vulnerabilities list.