CVE-2025-58034 KEV
7.2
HIGH · CVSS 3.1 · EPSS 55.6% (pctl 99)
Patch first
On CISA KEV — known exploited in the wild, due 2025-11-25.
Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Scoring
| CVSS | 7.2 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 55.58% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | yes — remediate by 2025-11-25 |
| Public exploit | none known |
| Published | 2025-11-18 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Fortinet FortiWeb OS Command Injection Vulnerability |
|---|---|
| Added | 2025-11-18 |
| Due | 2025-11-25 |
| Vendor / product | Fortinet / FortiWeb |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| fortinet | fortiweb |
References
→ the Explorer · watch your stack · NVD