CVE-2025-58034

Analyzed

Published: 18 Nov 2025, 17:16

Last modified:21 Nov 2025, 18:27

Vulnerability Summary

Overall Risk

High Risk

60/100

AI Analysis

Emergency

Requires Immediate Action

AI Detection

Active in Wild

Exploitation Detected

CVSS Score

7.2 HIGH

CVSS v3.1 (PSIRT)

EPSS Score

2.42% LOW

2% probability 0.00%

CISA KEV

Listed

Fortinet

Ransomware

Known Use

Exploits

None found

Dark Web

Activity detected

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Source Identifier: psirt@fortinet.com

CVSS	Source	Severity	Exploit.	Impact	Vector
v4.0	n/a
v3.1	psirt@fortinet.com	7.2 HIGH	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/U...
v3.0	n/a
v2.0	n/a

3.75%

Current Score

0.00%

88%ile

Percentile Rank

0.00%

Loading chart...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78

Description:The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Vulnerability Name:Fortinet FortiWeb OS Command Injection Vulnerability

Added to CISA Catalog:18 Nov 2025, 00:00

Action Due:25 Nov 2025, 00:00

Known Ransomware: Ransomware

Required Action:Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Telegram Activity Detected

This vulnerability has been mentioned in monitored Telegram channels, indicating potential threat actor interest.

No known public exploit code indexed (as of 21 Nov 2025, 18:27).

Exploitation status can change quickly once PoC code appears.