{"id":"CVE-2023-34993","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-34993","generatedAt":"2026-10-28T02:15:24.701Z","title":"A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http…","description":"A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.","published":"2023-10-10T17:15:12.000Z","lastModified":"2026-06-17T06:04:14.000Z","status":"Modified","sourceIdentifier":"psirt@fortinet.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["fortinet/fortiwlm"],"epss":{"score":0.21321,"percentile":0.97581,"date":"2026-10-26","history":[{"date":"2026-10-11","score":0.21321,"percentile":0.97552}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 21.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-140","tags":["Vendor Advisory"],"source":"psirt@fortinet.com"},{"url":"https://fortiguard.com/psirt/FG-IR-23-140","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-34993","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}