U.S. CISA adds a new Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

According to U.S. CISA, a Fortinet FortiWeb flaw, tracked as CVE-2025-58034, has been added to the Known Exploited Vulnerabilities (KEV) catalog and is being actively exploited in the wild. The vulnerability is an OS Command Injection flaw that allows an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands, with a CVSS score of 6.7.

Fortinet has patched the zero‑day, and the affected FortiWeb versions include 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11, with upgrades to 8.0.2, 7.6.6, 7.4.11, 7.2.12, or 7.0.12 respectively advised. The advisory notes that an authenticated attacker can trigger the flaw via crafted HTTP requests or CLI commands, and reads the vulnerability as an improper neutralisation of special elements used in an OS Command.

“Fortinet has observed this to be exploited in the wild.” As per Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address the identified flaws by the due date, with CISA urging private organisations to review the KEV catalog and patch accordingly, and to fix the vulnerabilities by 25 November 2025.