Fortinet patched a new FortiWeb zero-day, tracked as CVE-2025-58034, which attackers are actively exploiting.
Fortinet patched a new FortiWeb zero-day, tracked as CVE-2025-58034 (CVSS score 6.7), which is being actively exploited in attacks in the wild. Trend Micro researcher Jason McFadyen reported the vulnerability.
The flaw is an improper neutralization of special elements used in an OS Command (‘OS Command Injection’) vulnerability. An authenticated attacker can trigger the vulnerability to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
“An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.” reads the advisory. “Fortinet has observed this to be exploited in the wild.”
Below are the affected versions:
| Version | Affected | Solution |
|---|---|---|
| FortiWeb 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above |
| FortiWeb 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above |
| FortiWeb 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above |
| FortiWeb 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above |
| FortiWeb 7.0 | 7.0.0 through 7.0.11 | Upgrade to 7.0.12 or above |
Recently, Fortinet addressed another FortiWeb zero-day, tracked as CVE-2025-64446 (CVSS score of 9.1), actively exploited in attacks in the wild.
The vulnerability is a relative path traversal issue in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11. An attacker can exploit the flaw to execute administrative commands on the system by sending crafted HTTP or HTTPS requests to vulnerable devices.
“A relative path traversal vulnerability [CWE-23] in FortiWeb may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.” reads the advisory. “Fortinet has observed this to be exploited in the wild”
The cybersecurity vendor recommends disabling HTTP/HTTPS on internet-facing interfaces until upgrading. If management access is internal only, the risk is greatly reduced.
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Fortinet)
