Research · Nov 18, 2025 · ZeroDay Catalog
Critical OS Command Injection Vulnerability in Fortinet FortiWeb
A serious OS command injection vulnerability has been identified in multiple versions of Fortinet FortiWeb, allowing potential unauthorized code execution.
What changed
Fortinet has disclosed a vulnerability in its FortiWeb product that allows for OS command injection. This flaw, categorized under CWE-78, affects several versions of FortiWeb, enabling authenticated attackers to execute unauthorized commands on the underlying system through specially crafted HTTP requests or CLI commands.
Who is affected
The vulnerability impacts various versions of Fortinet FortiWeb, which is widely used in enterprise environments for web application security.
Organizations utilizing FortiWeb versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.5, 7.4.0 to 7.4.10, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.11 are at risk.
- Fortinet FortiWeb 8.0.0 through 8.0.1
- Fortinet FortiWeb 7.6.0 through 7.6.5
- Fortinet FortiWeb 7.4.0 through 7.4.10
- Fortinet FortiWeb 7.2.0 through 7.2.11
What to do
Organizations using affected versions of FortiWeb should prioritize applying the latest patches provided by Fortinet. It is crucial to assess the security posture and monitor for any unauthorized access attempts.
Additionally, review configurations and limit access to the management interfaces to reduce exposure.
- Apply patches from Fortinet immediately.
- Monitor logs for unusual activity.
- Restrict access to management interfaces.