Actively exploited in the wild
Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet - FortiWeb · Listed in the CISA KEV since 2025-11-18. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-58034
HighCVSS 7.2KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Risk Assessment
An authenticated attacker can execute arbitrary code on the FortiWeb appliance, potentially leading to full compromise of the device and the network traffic it handles.
Recommendation
Update FortiWeb to the latest fixed version in the relevant branch and restrict administrative access to trusted networks.
Other vulnerabilities in FortiWeb
See all- CVE-2026-26035Critical
An Improper Authentication vulnerability (CWE-287) in Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password.
- CVE-2026-40688High
An out-of-bounds write vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11 allows a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.
- CVE-2025-64447High
FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 rely on cookies without validation and integrity checking. An unauthenticated attacker may execute arbitrary operations on the system via crafted HTTP or HTTPS requests using forged cookies, requiring prior knowledge of the FortiWeb serial number.
- CVE-2026-70466Medium
Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.5, 7.4 (all), 7.2 (all), and 7.0 (all) have an incomplete list of disallowed inputs vulnerability, which may allow an attacker to cause improper access control.
- CVE-2026-39814Medium
Multiple Relative Path Traversal vulnerabilities [CWE-23] in Fortinet FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
- CVE-2025-66178High
An OS command injection vulnerability in Fortinet FortiWeb (versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12) stems from improper neutralization of special elements in OS commands. An authenticated attacker may execute arbitrary commands via a specially crafted HTTP request.
- CVE-2025-64471Medium
A use of password hash instead of password for authentication vulnerability [CWE-836] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests.
- CVE-2025-59669Medium
Fortinet FortiWeb versions 7.6.0, 7.4, 7.2, and 7.0 contain a use of hard-coded credentials vulnerability. An authenticated attacker with shell access can connect to the Redis service and access its data.
Original NVD description (English source)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS