Fortinet Warns of New Forti Web CVE-2025-58034 Vulnerability Exploited in the Wild
Summary: Fortinet warned of CVE-2025-58034, a medium-severity OS command injection flaw in FortiWeb with a CVSS score of 6.7 that requires an authenticated attacker to execute unauthorized code via crafted HTTP requests or CLI commands. The flaw was reported by Trend Micro researcher Jason McFadyen and arrives days after Fortinet silently patched a separate critical FortiWeb flaw, CVE-2025-64446 (CVSS 9.1), in version 8.0.2, with Orange Cyberdefense reporting campaigns chaining the two.
What you should know: CISA added CVE-2025-58034 to its KEV catalog and set a November 25, 2025 patch deadline for federal agencies, while Rapid7 assesses the pair likely forms an exploit chain for unauthenticated remote code execution against vulnerable FortiWeb devices.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-58034CVE-2025-64446
- Related
- ⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More Cyber Risks ·CVE-2025-58034: Fortinet Forti Web OS Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 18, 2025CVE-2025-64446: Fortinet Forti Web Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 14, 2025