Fortinet Woes Continue With Another WAF Zero-Day Flaw

Fortinet disclosed a second zero-day vulnerability in its FortiWeb product line, just days after revealing a separate flaw in its WAF that had been exploited in the wild. The newly disclosed vulnerability, CVE-2025-58034, is an OS command injection that can allow an authenticated attacker to run code on the WAF through crafted HTTP requests or CLI commands, with a medium severity and a 6.7 CVSS score, according to Fortinet's advisory.

France's Orange Cyberdefense said several exploitation campaigns are targeting CVE-2025-58034 in chained attacks with CVE-2025-64446, and Trend Micro researchers credited Jason McFadyen for reporting the flaw, noting around 2,000 detections of exploitation activity. Rapid7's technical analysis observed that both vulnerabilities were patched in prior updates, and suggested the two flaws may form an exploit chain for unauthenticated remote code execution, though they remain separate issues.

In mitigation, CISA added CVE-2025-58034 to its Known Exploited Vulnerabilities catalog and urged a rapid remediation timeframe, while Orange Cyberdefense recommended Fortinet customers update FortiWeb to fixed versions and avoid exposing management interfaces on the Internet.