6.7 Medium Exploited

CVE-2025-58034 Fortinet FortiWeb OS Command Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-78

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Affected products and versions

Product	Affected versions	Fixed in
FortiWeb 7.6	7.6.0 → 7.6.4	No fix stated
FortiWeb 7.4	7.4.0 → 7.4.8	No fix stated
FortiWeb 7.2	7.2.0 → 7.2.11	No fix stated
FortiWeb 7.0	7.0.2 → 7.0.11	No fix stated

References

fortiguard.fortinet.com fortiguard.fortinet.com

Timeline

Published November 18, 2025
Added to the KEV catalogue November 18, 2025
Last modified February 26, 2026

The 74 CVEs of FortiWeb →

CVE-2026-26035 An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb… 8.8 High CVE-2026-70466 A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through… 4.8 Medium CVE-2026-40688 An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0… 6.7 Medium CVE-2026-39811 A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6,… 4.4 Medium

Track this CVE