Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week

Fortinet has disclosed a second FortiWeb zero-day exploited in a week, tracked as CVE-2025-58034, an OS command injection flaw that allows authenticated attackers to execute arbitrary code via crafted HTTP requests or CLI commands. The vendor notes that this vulnerability has been exploited in the wild and has released patches for FortiWeb versions 8.0.2, 7.6.6, 7.4.11, 7.2.12, and 7.0.12, urging users to update promptly.

This marks the second FortiWeb zero-day publicly disclosed within a week, following Fortinet’s confirmation on 14 November that CVE-2025-64446, a critical path traversal issue, had been targeted in attacks. Simultaneously, the US Cybersecurity and Infrastructure Security Agency added CVE-2025-58034 to its Known Exploited Vulnerabilities catalog, prompting federal agencies to patch within a week.

The company also addressed 16 other vulnerabilities across FortiClient, FortiVoice and FortiWeb families, though Fortinet does not state that those bugs were exploited in the wild. According to Fortinet advisory, users should prioritise applying the FortiWeb updates to mitigate the risk.