FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection

Two critical FortiWeb vulnerabilities are actively being exploited: an unauthenticated relative path traversal (CWE-23) that can execute administrative commands via crafted HTTP/HTTPS requests, and an authenticated OS command injection (CWE-78) that enables execution of unauthorized code via crafted requests or CLI commands; FortiWeb systems are affected (FortiAppSec Cloud is not). Fortinet recommends disabling HTTP/HTTPS on internet-facing interfaces as a temporary mitigation and reviewing configurations and logs for unauthorized changes while upgrades are applied.