{"id":"CVE-2025-58034","kind":"vulnerability","aliases":["CVE-2025-58034"],"related":[],"title":"fortinet fortiweb: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78]…","description":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.","summary":"Fortinet FortiWeb, a web application firewall appliance, has an OS command injection flaw that lets an authenticated attacker run unauthorized commands on the underlying system via crafted HTTP requests or CLI commands. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2025-11-18T00:00:00+00:00","products":[{"name":"fortinet fortiweb","fixed":["7.0.12"],"affected":">= 7.0.0, < 7.0.12","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.2.12"],"affected":">= 7.2.0, < 7.2.12","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.4.11"],"affected":">= 7.4.0, < 7.4.11","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["7.6.6"],"affected":">= 7.6.0, < 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":["8.0.2"],"affected":">= 8.0.0, < 8.0.2","ecosystem":"vendor"},{"name":"Fortinet FortiWeb","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortinet","fortiweb","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations from Fortinet's vendor advisory; if none are available, discontinue use of the product per CISA guidance.","status":"open","published_at":"2025-11-18T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:19+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:44:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Fortinet's vendor advisory; if none are available, discontinue use of the product per CISA guidance.\nunknown","reach":"network","summary":"Fortinet FortiWeb, a web application firewall appliance, has an OS command injection flaw that lets an authenticated attacker run unauthorized commands on the underlying system via crafted HTTP requests or CLI commands. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["fortiweb","fortinet","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary commands on the FortiWeb appliance operating system.","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-58034 to get affected and fixed FortiWeb versions and the specific mitigation steps and checks.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000448,"input_tokens":2554,"output_tokens":385,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':21A,24A '-58034':22A,25A '-78':19A,102C '7.0.0':123C '7.0.11':125C '7.2.0':119C '7.2.11':121C '7.4.0':115C '7.4.10':117C '7.6.0':111C '7.6.5':113C '8.0.0':107C '8.0.1':109C 'activ':81B 'allow':127C 'applianc':51B 'applic':49B 'attack':62B,130C 'authent':61B,129C 'cisa':77B 'cli':75B,144C 'code':134C 'command':13A,15A,55B,65B,76B,96C,98C,145C 'craft':71B,140C 'cve':20A,23A 'cwe':18A,101C 'element':8A,91C 'execut':132C 'exploit':38B,82B 'firewal':50B 'flaw':57B 'fortinet':1A,26A,28A,30A,32A,34A,36A,39B,45B,105C 'fortiweb':2A,27A,29A,31A,33A,35A,37A,40B,46B,106C,110C,114C,118C,122C 'host':44B 'http':72B,141C 'improp':4A,87C 'infrastructur':41B 'inject':16A,56B,99C 'let':59B 'list':78B 'may':126C 'neutral':5A,88C 'os':12A,14A,54B,95C,97C 'request':73B,142C 'run':63B 'self':43B 'self-host':42B 'special':7A,90C 'system':69B,138C 'unauthor':64B,133C 'under':68B,137C 'use':9A,92C 'via':70B,139C 'vulner':17A,100C,103C 'web':48B 'wild':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-18T00:00:00+00:00","kev":{"dateAdded":"2025-11-18","dueDate":"2025-11-25","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-58034","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-58034","severity":null,"published_at":"2025-11-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-58034","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58034","severity":null,"published_at":"2025-11-18T17:16:05+00:00","modified_at":"2026-10-18T20:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}