CVE-2025-58034: FortiWeb OS command injection via crafted HTTP or CLI input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote command execution on an edge appliance and is listed in CISA KEV with a one-week remediation deadline.

What it is

FortiWeb versions 7.0.0 through 8.0.1 contain an OS command injection flaw (CWE-78) that lets an authenticated attacker run unauthorized code on the underlying system using crafted HTTP requests or CLI commands. It matters because the product sits at the network edge and the flaw is already listed in CISA KEV with a short remediation deadline.

Impact

An attacker with valid credentials gains arbitrary command execution on the FortiWeb host, which can lead to full compromise of the appliance and any data or trust relationships it holds.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but it requires high privileges (PR:H), meaning the attacker must already hold an authenticated administrative or similarly privileged account.

Exploitation

CVE-2025-58034 was added to CISA KEV on 2025-11-18 with a due date of 2025-11-25, indicating known exploitation in the wild; EPSS 30-day probability is 0.5558 (99th percentile). No ransomware campaign use is documented.

What to do

• Upgrade FortiWeb to a fixed release per Fortinet PSIRT advisory FG-IR-25-513; patch first.
• If patching is not immediately possible, apply the vendor's documented workarounds or restrict management access to trusted networks.
• Enforce least privilege and strong authentication on FortiWeb administrative and CLI accounts, and audit for unused or shared accounts.
• Segment the FortiWeb appliance from sensitive internal systems to limit lateral movement if it is compromised.
• Follow BOD 22-01 guidance for cloud-hosted instances or discontinue use if mitigations are unavailable.

Detection

• Monitor FortiWeb and upstream logs for suspicious HTTP requests or CLI commands containing shell metacharacters or unexpected process invocations.
• Alert on unexpected child processes or command shells spawned by the FortiWeb web or management service.
• Review authentication logs for anomalous or off-hours administrative logins preceding command execution.
• Hunt for new outbound connections or file changes on the FortiWeb host that do not match normal appliance behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.