CVEFinder.io

CVE-2025-66178

⚠️ high
Summary

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.

CVSS Score
7.2
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-03-10
First Seen: 2026-03-11
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 54.3% of all 365,890 vulnerabilities in our database.

#167,176
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Mar 10, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-03-12
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-78

📦 Affected Products 5

Vendor Product Status Affected Versions
fortinet fortiweb Affected
> 7.0.0 < 7.0.13
fortinet fortiweb Affected
> 7.2.0 < 7.2.13
fortinet fortiweb Affected
> 7.4.0 < 7.4.12
fortinet fortiweb Affected
> 7.6.0 < 7.6.7
fortinet fortiweb Affected
> 8.0.0 < 8.0.3

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-26-088
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-26035 ⛔ critical 9.8 0.7 An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.... 2026-08-12
CVE-2026-70466 🔶 medium 5.3 0.3 A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.... 2026-08-12
CVE-2026-39811 🔶 medium 4.9 0.1 A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, F... 2026-04-14
CVE-2026-39814 🔶 medium 6.7 0.0 A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb... 2026-04-14
CVE-2026-40688 ⚠️ high 7.2 6.4 An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 th... 2026-04-14
CVE-2025-48840 🔶 medium 5.3 0.1 An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.... 2026-03-10
These CVEs affect the same products