Fortinet FortiWeb OS Command Injection Vulnerability

Public source report. This item is not matched to your stack and does not establish whether you are affected.

• NewsExploited · CISA KEVFortinet · FortiWeb

  Fortinet FortiWeb OS Command Injection Vulnerability

  CVE-2025-58034

  Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

  CISA's required action · due 25 Nov 2025 for U.S. federal civilian agencies

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  Cited by CISA: fortiguard.fortinet.com · nvd.nist.gov

  Added to KEV 18 Nov 2025 · Source checked 4 Nov 2026, 16:40 UTC · CISA KEV entry

  Loading voting…