Advisory addresses a vulnerability that could allow an authenticated attacker to perform remote code execution via crafted HTTP requests or CLI commands
Advisory addresses a vulnerability that could allow an authenticated attacker to perform remote code execution via crafted HTTP requests or CLI commands
The following platforms are known to be affected:
Fortinet has reported exploitation of CVE-2025-58034
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-58034 to their Known Exploited Vulnerabilities (KEV) Catalog. NHS England National CSOC assesses future exploitation as likely.
Fortinet has released a security update to address an exploited vulnerability for FortiWeb.
Affected organisations are strongly encouraged to review Fortinet PSIRT advisory FG-IR-25-513 and apply the relevant updates as soon as possible.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Last edited: 19 November 2025 12:54 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
