CVE-2021-36182: Fortinet FortiWeb

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests

Affected products

• Fortinet FortiWeb: up to and including 6.2.4; from 6.3.0, before 6.3.14 (fixed in 6.3.14)

Published 2021-09-08. Last modified 2026-06-17.