What is the CVSS score of CVE-2025-66178?

CVE-2025-66178 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fortiweb are affected by CVE-2025-66178?

FortiWeb Web Application Firewalls across multiple versions contain a command injection vulnerability that allows authenticated users to execute arbitrary commands on affected systems.

How to fix or mitigate CVE-2025-66178?

Within 24 hours: Identify all FortiWeb instances in your environment and document which versions are running (7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.5, 8.0.0-8.0.1); audit administrative access logs for suspicious activity; restrict admin access to FortiWeb consoles to essential personnel only. Within 7 days: Implement network segmentation to limit access to FortiWeb management interfaces; enable enhanced logging and monitoring for command execution attempts; coordinate with Fortinet support for patch availability timeline. Within 30 days: Deploy patched versions immediately upon release; conduct forensic analysis for any compromise indicators; review and strengthen authentication controls for administrative access.

Fortiweb CVE-2025-66178

HIGH

OS Command Injection (CWE-78)

2026-03-10 psirt@fortinet.com

Fortinet Command Injection Fortiweb

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:17 nvd

HIGH 7.2

DescriptionNVD

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.

AnalysisAI

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Fortiweb. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-66178 vulnerability details – vuln.today

Back

Fortiweb CVE-2025-66178

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code