CISA Flags Critical Fortinet FortiWeb Vulnerability: CVE-2025-58034 Joins KEV Catalog
In November 2025, CISA added CVE-2025-58034, a Fortinet FortiWeb OS Command Code Injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of in-the-wild exploitation against internet-exposed FortiWeb appliances. Threat actors leveraged this critical flaw to execute arbitrary system commands remotely, enabling them to gain unauthorized access, pivot laterally, or deploy additional malware. The urgency was amplified by ongoing exploitation and a recently published Fortinet security advisory, prompting CISA to recommend an accelerated one-week remediation deadline for federal and enterprise environments. This incident exemplifies the continued targeting of web application infrastructure by attackers exploiting unpatched devices. The rapid exploitation timeline, coupled with directives like BOD 23-02, highlights the increasing regulatory focus and operational risk posed by known—but unremediated—vulnerabilities in public-facing systems.
Kill Chain
