New FortiWeb zero-day CVE-2025-58034 under attack patched by Fortinet

Fortinet patched a new FortiWeb zero-day, tracked as CVE-2025-58034, which is being actively exploited in attacks in the wild, according to Fortinet’s advisory. The flaw is an improper neutralization of special elements used in an OS Command Injection vulnerability (CWE-78) that can allow an authenticated attacker to execute code on the underlying system via crafted HTTP requests or CLI commands, with a CVSS score of 6.7.

The advisory states that this vulnerability is already being abused in the wild and provides a list of affected FortiWeb versions, advising upgrades to specific versions: FortiWeb 8.0 from 8.0.0 through 8.0.1 to 8.0.2 or above; 7.6 from 7.6.0 through 7.6.5 to 7.6.6 or above; 7.4 from 7.4.0 through 7.4.10 to 7.4.11 or above; 7.2 from 7.2.0 through 7.2.11 to 7.2.12 or above; and 7.0 from 7.0.0 through 7.0.11 to 7.0.12 or above.

Fortinet notes a prior FortiWeb zero-day, CVE-2025-64446, and last week CISA added the Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog. According to the advisory FG-IR-25-513, Fortinet has observed this vulnerability being exploited in the wild.