PT-2025-32876 · Fortinet · Fortiweb

Published 2025-08-12 · Updated 2025-08-13 · CVE-2025-27759

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 7.6.0 through 7.6.3 Fortinet FortiWeb versions 7.4.0 through 7.4.7 Fortinet FortiWeb versions 7.2.0 through 7.2.10 Fortinet FortiWeb versions prior to 7.0.10

Description: A flaw exists in the improper neutralization of special elements used in an OS command, potentially leading to unauthorized code or command execution. This issue affects authenticated privileged attackers who can manipulate commands through the Command Line Interface (CLI).

Recommendations: Fortinet FortiWeb version 7.6.0 through 7.6.3: Update to a version beyond 7.6.3. Fortinet FortiWeb version 7.4.0 through 7.4.7: Update to a version beyond 7.4.7. Fortinet FortiWeb version 7.2.0 through 7.2.10: Update to a version beyond 7.2.10. Fortinet FortiWeb versions prior to 7.0.10: Update to version 7.0.10 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-27759

Affected Products

Fortiweb

References · 5

• https://osv.dev/vulnerability/CVE-2025-27759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27759 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-150 · Vendor Advisory
• https://twitter.com/CVEnew/status/1955535849833308167 · Twitter Post
• https://t.me/cveNotify/131934 · Telegram Post