CyberzSOC

CISA has updated this Alert to include an additional vulnerability, CVE-2025-58034, and its relation to CVE-2025-64446, and associated resources. CISA is aware of the exploitation of two vulnerabilities, CVE-2025-64446 and CVE-2025-58034 , in Fortinet FortiWeb, a web application firewall. CISA is also aware that threat actors could exploit CVE-2025-64446 as an initial access vector and then chain CVE-2025-58034 to escalate privileges on a target system. These vulnerabilities chained together could lead to unauthenticated remote code execution against vulnerable FortiWeb products. CVE-2025-64446 is a relative path traversal vulnerability ( CWE-23: Relative Path Traversal ) that may allow an unauthenticated malicious actor to execute administrative commands on a system via specially crafted HTTP or HTTPS requests. CVE-2025-58034 is an OS Command Injection vulnerability ( CWE-78: Improper Neutralization of Special Elements used in an OS Command [‘OS Command Injection’] ) that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.