PT-2025-47361 · Fortinet · Fortiweb

Published

2025-11-18

·

Updated

2025-12-04

·

CVE-2025-58034

CVSS v2.0
9.0
VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 7.0.0 through 8.0.1 Fortinet FortiWeb versions 7.2.0 through 7.2.11 Fortinet FortiWeb versions 7.4.0 through 7.4.10 Fortinet FortiWeb versions 7.6.0 through 7.6.5
Description Fortinet FortiWeb is affected by an OS Command Injection vulnerability. Successful exploitation of this issue allows an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. This vulnerability is actively being exploited in the wild. Approximately 10.5K services are currently exposed.
Recommendations FortiWeb versions 7.0.0 through 7.0.11 should be updated. FortiWeb versions 7.2.0 through 7.2.11 should be updated. FortiWeb versions 7.4.0 through 7.4.10 should be updated. FortiWeb versions 7.6.0 through 7.6.5 should be updated. FortiWeb versions 8.0.0 through 8.0.1 should be updated.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14466
CVE-2025-58034
ZDI-25-1014

Affected Products

Fortiweb