CISA gives govt agencies 7 days to patch new Fortinet flaw

CISA has ordered U.S. federal agencies to urgently patch Fortinet FortiWeb (CVE-2025-58034), an authenticated OS command injection that can allow root-level code execution via crafted HTTP/CLI requests; the flaw is actively exploited in the wild, was reported by Trend Micro, and was added to CISA's Known Exploited Vulnerabilities catalog with a one-week remediation deadline. The report also notes a related FortiWeb zero-day (CVE-2025-64446) and prior Fortinet vulnerabilities used in espionage and ransomware campaigns.