FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection

Two critical FortiWeb vulnerabilities are being actively exploited: an unauthenticated relative path traversal (CWE-23) allowing administrative command execution via crafted HTTP(S) requests, and an authenticated OS command injection (CWE-78) enabling attackers to run unauthorized code via HTTP requests or CLI commands. Fortinet advises disabling HTTP/HTTPS access on internet-facing interfaces as a temporary mitigation, reviewing configurations and logs for unauthorized changes, and performing upgrades; FortiAppSec Cloud is not affected.