UpHeron
All vulnerabilities

Servers and applications

CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 18 Nov 2025.

Severity
High 7.2
Published
18 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.0.12, 7.2.12, 7.4.11, 7.6.6, 8.0.2
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiWebServers and applications · cpe:a:fortinet:fortiweb
  • From 7.0.0 before 7.0.12
  • From 7.2.0 before 7.2.12
  • From 7.4.0 before 7.4.11
  • From 7.6.0 before 7.6.6
  • From 8.0.0 before 8.0.2

Known exploited

CISA name
Fortinet FortiWeb OS Command Injection Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
25 Nov 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-58034
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-58034