CVE entry · CVE-2025-58034
CVE-2025-58034: Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
- Actively exploited: added to CISA’s KEV catalog on November 18, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 25, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Fortinet FortiWeb, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (fortiguard.fortinet.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Fortinet vulnerabilities
-
Fortinet Multiple Products Path Traversal Vulnerability
-
Fortinet FortiMail Path Traversal Vulnerability
-
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
-
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
-
Fortinet FortiSandbox OS Command Injection Vulnerability
-
Fortinet FortiSandbox OS Command Injection Vulnerability