CVE Watch—

CVE-2025-58034

Fortinet FortiWeb OS Command Injection Vulnerability

CVSS

—

No CVSS

EPSS

55.6%

p99

KEV

YES

Nov 18, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

54.4%EPSS · 30 days55.6%

2026-06-302026-07-16

KEV catalog record

Product

Fortinet / FortiWeb

Vulnerability

Fortinet FortiWeb OS Command Injection Vulnerability

Added to KEV

Nov 18, 2025

Remediate by

Nov 25, 2025

Known ransomware use

Summary description

Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://fortiguard.fortinet.com/psirt/FG-IR-25-513 ; https://nvd.nist.gov/vuln/detail/CVE-2025-58034

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-25257—

99.9%

KEV—80Fortinet FortiWeb SQL Injection Vulnerability—CVE-2025-64446—

99.8%

KEV—80Fortinet FortiWeb Path Traversal Vulnerability—