FortiWeb 7.2 vulnerabilities
5 advisories affect Fortinet FortiWeb 7.2, 3 already exploited by attackers. Latest: August 12, 2026.
Running FortiWeb 7.2 devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on FortiWeb 7.2 alerts
Turn on FortiWeb 7.2 alerts
| Vulnerability | Severity | Affected versions |
|---|---|---|
| Fortinet: Broken access control in the RADIUS type admin group FG-IR-26-158 · August 12, 2026 | Critical 9.8 | from 7.2.0 to 7.2.12 Fixed in 7.2.13 |
| Fortinet: Content-Encoding WAF Evasion FG-IR-26-157 · August 12, 2026 | Medium 5.3 | all versions 7.2 (migrate to a fixed release) |
| Fortinet FortiWeb OS Command Injection Vulnerability CVE-2025-58034 · November 18, 2025 | High 7.2 Exploited | from 7.2.0 to 7.2.11 |
| Fortinet FortiWeb Path Traversal Vulnerability CVE-2025-64446 · November 14, 2025 | Critical 9.8 Exploited | from 7.2.0 to 7.2.11 |
| Fortinet FortiWeb SQL Injection Vulnerability CVE-2025-25257 · July 18, 2025 | Critical 9.8 Exploited | from 7.2.0 to 7.2.10 |
Affected versions are compiled automatically from vendor advisories and NVD and may contain errors. Where no fixed version is shown, you will find it in the official advisory linked from every page: check it there before updating.