Fortinet has confirmed a second zero-day vulnerability in its FortiWeb web application firewall, CVE-2025-58034. This OS command injection vulnerability allows authenticated attackers to execute unauthorized code on the underlying system using crafted HTTP requests or CLI commands.
The new bug was discovered by Trend Micro researcher Jason McFadyen and reported to the vendor. The company has since issued a patch and warned that the two vulnerabilities might be linked, potentially creating an exploit chain for unauthenticated remote code execution (RCE).
Fortinet’s security advisory noted that attackers have already exploited the new bug, with around 2,000 detections recorded by Trend Micro. The US Cybersecurity and Infrastructure Security Agency (CISA) has also added the vulnerability to its Known Exploited Vulnerability catalog.
The patch is available for FortiWeb devices running on the most recent software version. Experts believe that the two vulnerabilities might be connected, creating a potentially more serious security risk.
Source: https://www.theregister.com/2025/11/19/fortinet_confirms_second_fortiweb_0day