CVE · Exploited · On CISA KEV

CVE-2025-58034

Fortinet FortiWeb OS Command Injection Vulnerability

7.2: CVSS 3.1
1: story
NOV 18: added to KEV

Severity: 7.2 High · vendor score
Vendor: Fortinet
Product: FortiWeb
Published: Nov 18, 2025
Added to KEV: Nov 18, 2025
KEV deadline: Nov 25, 2025
Ransomware use: Unknown
Weakness: CWE-78

What it is

Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

NOV 17
VulnerabilitiesFortinet CVE-2025-64446 Under Active AttackThat vulnerability (CVE-2025-64446) affects several versions of FortiWeb and CISA has added it to its Known Exploited Vulnerabilities catalog.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryfortiguard.fortinet.com/psirt/FG-IR-25-513