CISA KEV Alert: FortiWeb RCE Flaw (CVE-2025-58034) Under Active Exploitation for Command Injection

Fortinet has issued an urgent advisory warning that a newly disclosed vulnerability in FortiWeb, tracked as CVE-2025-58034, is being actively exploited in the wild, prompting CISA to add the flaw to its Known Exploited Vulnerabilities Catalog. According to Fortinet’s advisory, the OS Command Injection flaw may allow an authenticated attacker to execute arbitrary commands on the underlying system via crafted HTTP requests or CLI inputs.

Exploitation requires authentication, but many deployments rely on shared admin credentials or weak passwords, which increases attacker success. The flaw could enable direct execution of arbitrary commands on the device, potentially leading to complete administrative takeover, the implantation of backdoors, web traffic manipulation, and lateral movement within protected networks.

Fortinet’s advisory lists affected FortiWeb versions and upgrade paths, with upgrades recommended to 8.0.2 or above for 8.0, 7.6.6 or above for 7.6, 7.4.11 or above for 7.4, 7.2.12 or above for 7.2, and 7.0.12 or above for 7.0. Administrators should prioritise upgrades and review authentication policies around FortiWeb management access.