DaystoPatch

FortinetExploited incident

FortiWeb authenticated OS command injection exploited in the wild

CVE-2025-58034High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 18 Nov 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-58034 (CNA: Fortinet)CuratedQuote verified

    "assignerShortName":"fortinet","dateReserved":"2025-08-22T13:55:12.100Z","datePublished":"2025-11-18T17:01:13.513Z"

    Fortinet's disclosure, which already said the bug was exploited, is the first public signal found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f809200cca4649d…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Fortinet advisory FG-IR-25-513ClaimedQuote verified18 Nov 2025

    Multiple OS command injection in API and CLI

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-25-513 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bcfe16c37c2abac6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-58034)ClaimedQuote verified18 Nov 2025

    Fortinet FortiWeb OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-11-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-25-513 (Wayback snapshot 2025-11-18 19:37 UTC)CuratedQuote verified18 Nov 2025

    Fortinet has observed this to be exploited in the wild.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:01fee1e946deaba2…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-58034ClaimedQuote verified18 Nov 2025, 17:01 UTC

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f809200cca4649d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet18 Nov 2025, 17:43 UTC

    You can now share your thoughts on vulnerability CVE-2025-58034 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Nov 2025, 12:54 UTC

    [VULN] ⚠️Fortinet : encore une faille zero-day dans FortiWeb (CVE-2025-58034) "Il y a quelques jours, Fortinet a dévoilé une première faille de sécurité zero-day dans FortiWeb : CVE-2025-64446. Dans le sillage de cette première vulnérabilité,

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-58034 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2025-11-18T17:01:13.513Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f809200cca4649d…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-513CuratedQuote not checked yet18 Nov 2025

    2025-11-18: Initial publication

    Source
    Fortinet PSIRT FG-IR-25-513 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Help Net SecurityCuratedQuote not checked yet

    These fixed versions were released between October 23 and 31, 2025, with no mention of either CVE-2025-58034 or CVE-2025-64446

    The fixed versions (FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12) were released between 2025-10-23 and 2025-10-31; the first of them on 2025-10-23 (which branch is not stated).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    BleepingComputerCuratedQuote verified28 Oct 2025

    which confirms that the zero-day has been patched in FortiWeb 8.0.2, released on October 28

    This article is about CVE-2025-64446, but it dates the FortiWeb 8.0.2 release, and FG-IR-25-513 lists 8.0.2 as the fix for CVE-2025-58034 on the 8.0 branch ('8.0.0 through 8.0.1 Upgrade to 8.0.2 or above'). Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Source
    BleepingComputer news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6cddc79c90d06ee0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Help Net SecurityCuratedQuote not checked yet

    These fixed versions were released between October 23 and 31, 2025, with no mention of either CVE-2025-58034 or CVE-2025-64446

    R6: all five fixed versions were out by 2025-10-31, before the 2025-11-18 advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-513 (Wayback snapshot 2025-11-18 19:37 UTC)CuratedQuote verified18 Nov 2025

    Upgrade to 7.6.6 or above

    First-day advisory lists released fixes for every branch (8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12), none 'upcoming'. Release dates of 7.6.6 and 7.4.11 were not found, so this is the date all fixes were confirmed available.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:01fee1e946deaba2…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiWeb
How we built this timeline

Previously null: 8.0.2 (a fixed release) shipped 28 Oct 2025 and exploitation was first reported publicly on 18 Nov 2025, but when exploitation began, and whether the 7.6.6/7.4.11 fixes predate it, is unknown. Trend Micro told The Register it saw 'around 2,000 detections'.

Researchers (The Register) think it chains with CVE-2025-64446 for unauthenticated RCE, but Fortinet has not said so; kept as a separate incident. Severity: Fortinet labels it 'Medium' but its CVSSv3 score is 7.2, which is 'high' on the guide's scale.

Requires authentication on its own. The advisory metadata still says 'Known Exploited No' despite the summary text.

R4 (23 Oct 2026): exploited before a fix changed from null to false. A complete fixed release (FortiWeb 8.0.2, 28 Oct 2025) was public before the earliest public evidence of exploitation (Fortinet's advisory, 18 Nov 2025); the exploitation start date is unknown.

Audit 2 (23 Oct 2026): First fix moved to 23 Oct 2025 and Fixed for all versions to 31 Oct 2025 (Help Net Security: fixed versions 'released between October 23 and 31, 2025'). T2 search for later post-mortems before keeping exploited before a fix=false: Help Net Security (19 Nov 2025) says 'It’s currently unclear whether CVE-2025-58034 was likewise exploited as a zero-day';

Trend Micro reported ~2,000 detections without a first-seen date; Orange Cyberdefense reported campaigns chaining it with CVE-2025-64446 after disclosure.

No source dates exploitation before 23 Oct 2025, so the value stays false under R4.

Related

Fortinet report card