Fortinet FortiWeb Zero-Day Vulnerability (CVE-2025-58034) Exploited in the Wild

THE THREAT

On November 18th, 2025, Fortinet disclosed an actively exploited zero-day vulnerability impacting Fortinet FortiWeb versions. The vulnerability, tracked as CVE-2025-58034 (CVSS: 6.7), is a OS command injection vulnerability due to improper neutralization of special elements used in an OS command. CVE-2025-58034 may allow an authenticated attacker to execute arbitrary code on the vulnerable system via crafted HTTP requests or CLI commands. Successful exploitation can enable an attacker to gain complete control over the compromised device.

Fortinet confirmed that CVE-2025-58034 is being exploited in the wild, making it critical for the organizations to patch the flaw and upgrade the vulnerable instances to secure versions.

What we're doing about it

• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Fortinet

Additional information

Fortinet stated in its advisory that "Fortinet has observed this to be exploited in the wild." In response, CISA has added CVE-2025-58034 to its Known Exploited Vulnerabilities (KEV) catalog, requiring U.S. Federal agencies to apply patches by November 25, 2025. Shortly after Fortinet's disclosure, the Canadian Centre for Cyber Security (CCCS) issued an alert for CVE-2025-25256, further underscoring the severity of the issue. At the time of writing, technical details regarding the exploitation of the vulnerability are not available, and Proof-of-Concept (PoC) exploit code has not been identified. The vulnerability was reported by Jason McFadyen from Trend Micro under responsible disclosure.

Fortinet had recently disclosed a high-severity vulnerability, CVE-2025-64446. At the time of writing, it remains unclear whether this flaw and the newly disclosed vulnerability are related or could be chained together for broader exploitation. The difference between the two vulnerabilities is as follows:

• CVE-2025-64446: Allows unauthenticated attackers to exploit a path traversal flaw to create administrator-level accounts without valid credentials, providing immediate privileged access.
• CVE-2025-58034: Requires authenticated access, but once a valid session is obtained, the vulnerability enables arbitrary command execution on the underlying system, allowing attackers to escalate their activity post-authentication.

However, the overlap in the impacted FortiWeb versions noted in Fortinet's advisory raises concern about potential shared root causes or attack paths that adversaries may attempt to leverage.

Given the short timeframe between the initial observation of CVE-2025-64446 and the public acknowledgement of CVE-2025-25256, organizations should prioritize immediate action.

References:
[1] https://fortiguard.fortinet.com/psirt/FG-IR-25-513
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-58034
[3] https://cwe.mitre.org/data/definitions/78.html
[4] https://www.cisa.gov/news-events/alerts/2025/11/18/cisa-adds-one-known-exploited-vulnerability-catalog
[5] https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av25-769
[6] https://nvd.nist.gov/vuln/detail/CVE-2025-64446
[7] https://www.esentire.com/security-advisories/fortinet-fortiweb-vulnerability-exploited-cve-2025-64446