---
id: "CVE-2025-58034"
kind: "vulnerability"
aliases: ["CVE-2025-58034"]
title: "fortinet fortiweb: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78]\u2026"
severity: "high"
cvss: 7.2
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "fortinet fortiweb", "fixed": ["7.0.12"], "affected": ">= 7.0.0, < 7.0.12", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.2.12"], "affected": ">= 7.2.0, < 7.2.12", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.4.11"], "affected": ">= 7.4.0, < 7.4.11", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.6.6"], "affected": ">= 7.6.0, < 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["8.0.2"], "affected": ">= 8.0.0, < 8.0.2", "ecosystem": "vendor"}, {"name": "Fortinet FortiWeb", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortinet", "fortiweb", "infrastructure", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2025-11-18T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-58034", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58034", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# fortinet fortiweb: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78]…

Fortinet FortiWeb, a web application firewall appliance, has an OS command injection flaw that lets an authenticated attacker run unauthorized commands on the underlying system via crafted HTTP requests or CLI commands. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fortinet fortiweb affected >= 7.0.0, < 7.0.12 fixed 7.0.12
- vendor:fortinet fortiweb affected >= 7.2.0, < 7.2.12 fixed 7.2.12
- vendor:fortinet fortiweb affected >= 7.4.0, < 7.4.11 fixed 7.4.11
- vendor:fortinet fortiweb affected >= 7.6.0, < 7.6.6 fixed 7.6.6
- vendor:fortinet fortiweb affected >= 8.0.0, < 8.0.2 fixed 8.0.2
- vendor:Fortinet FortiWeb affected ? fixed ?

## Fix

Apply the mitigations from Fortinet's vendor advisory; if none are available, discontinue use of the product per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-58034
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-58034

## From the sources

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_