CVE-2025-58034 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-11-18

Added to CISA KEV: 2025-11-18 0 DAY BETWEEN CVE AND KEV

CRITICAL: Immediately check for indicators of compromise - review FortiWeb logs for suspicious HTTP requests, unauthorized CLI access, or evidence of command execution. Verify system integrity and check for persistence mechanisms
URGENT: Apply patches immediately - upgrade to FortiWeb 8.0.2+, 7.6.6+, 7.4.11+, 7.2.12+, or 7.0.12+ depending on current version branch
Monitor FortiWeb access logs closely for unusual authentication patterns, failed login attempts, and suspicious HTTP request patterns that could indicate exploitation attempts
PATCH PRIORITY: CRITICAL - This should be treated as emergency patching due to active exploitation and internet-facing nature of the product

CVE-2025-58034 — Fortiweb | dbugs
Details on CVE-2025-58034: Fortiweb. Includes CVSS score, affected versions, and references.An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11. may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Fix.
Fortinet FortiWeb CVE-2025-58034 OS Command Injection – Brief Summary ...
CVE-2025-58034 is a high-severity OS command injection vulnerability in Fortinet FortiWeb, potentially allowing authenticated attackers to run arbitrary commands on the underlying system. FortiWeb is Fortinet's dedicated web application firewall, widely deployed to protect web applications from a range of attacks.
Fortinet warns of new FortiWeb zero-day exploited in attacks
Today, Fortinet released security updates to patch a new FortiWeb zero-day vulnerability that threat actors are actively exploiting in attacks. Tracked as CVE-2025-58034, this web application ...

🔴 CVE-2025-58034