U.S. CISA has added a second Fortinet FortiWeb vulnerability in just a few days to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiWeb flaw, tracked as CVE-2025-58034 (CVSS score of 6.7), to its Known Exploited Vulnerabilities (KEV) catalog.
This week, Fortinet patched a new FortiWeb zero-day, tracked as CVE-2025-58034, which is being actively exploited in attacks in the wild. Trend Micro researcher Jason McFadyen reported the vulnerability.
The flaw is an improper neutralization of special elements used in an OS Command (‘OS Command Injection’) vulnerability. An authenticated attacker can trigger the vulnerability to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
“An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.” reads the advisory. “Fortinet has observed this to be exploited in the wild.”
Below are the affected versions:
| Version | Affected | Solution |
|---|---|---|
| FortiWeb 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above |
| FortiWeb 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above |
| FortiWeb 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above |
| FortiWeb 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above |
| FortiWeb 7.0 | 7.0.0 through 7.0.11 | Upgrade to 7.0.12 or above |
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by November 25, 2025.
Recently, Fortinet addressed another FortiWeb zero-day, tracked as CVE-2025-64446 (CVSS score of 9.1), actively exploited in attacks in the wild.
The vulnerability is a relative path traversal issue in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11. An attacker can exploit the flaw to execute administrative commands on the system by sending crafted HTTP or HTTPS requests to vulnerable devices.
“A relative path traversal vulnerability [CWE-23] in FortiWeb may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.” reads the advisory. “Fortinet has observed this to be exploited in the wild”
The cybersecurity vendor recommends disabling HTTP/HTTPS on internet-facing interfaces until upgrading. If management access is internal only, the risk is greatly reduced.
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
