Security Affairspublished Aug 17, 00:26 UTC (Aug 17, 2025)ingested Sep 10, 06:12 UTC@securityaffairs

Security Affairs newsletter Round 537 by Pierluigi Paganini

criticalRansomware exploited in the wildimportance 60CVE-2025-25256

Read the original

Tagscve-2025-25256 ransomware

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-25256	Unauthenticated OS command injection in Fortinet FortiSIEM (CVE-2025-25256) CVE-2025-25256 is a critical (CVSS 9.8) OS command injection flaw (CWE-78) in Fortinet's FortiSIEM SIEM platform. An unauthenticated attacker can trigger it by sending specially crafted CLI requests over the network, which the appliance fails to properly neutralize before execution. Successful exploitation allows the attacker to execute unauthorized code or commands on the affected system without credentials or user interaction, effectively giving control of the appliance. Essentially every currently supported and many older FortiSIEM releases are affected, spanning versions 4.7 through 7.3.1. Fortinet has confirmed exploit code is being used in the wild, and the flaw carries a high 60.3% EPSS probability of exploitation within 30 days, though it is not yet in CISA's KEV catalog. Do: Upgrade FortiSIEM to a fixed release per Fortinet's security advisory, ensuring the deployed version falls outside all affected ranges listed above; given in-the-wild exploitation and a ~60% EPSS probability, prioritize externally reachable instances. Until patched, restrict network access to the appliance's CLI/management-facing services and review logs for unexpected commands or connections that may indicate compromise.	9.8	60%		Fortinet FortiSIEM 7.3.0-7.3.1, 7.2.0-7.2.5, 7.1.0-7.1.7, 7.0.0-7.0.3, 6.7.0-6.7.9; 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9, 4.7 (all versions)	largetens of thousands of deployed FortiSIEM instances worldwide (order-of-magnitude estimate)	Aug 12, 2025

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-25256

Unauthenticated OS command injection in Fortinet FortiSIEM (CVE-2025-25256)

CVE-2025-25256 is a critical (CVSS 9.8) OS command injection flaw (CWE-78) in Fortinet's FortiSIEM SIEM platform. An unauthenticated attacker can trigger it by sending specially crafted CLI requests over the network, which the appliance fails to properly neutralize before execution. Successful exploitation allows the attacker to execute unauthorized code or commands on the affected system without credentials or user interaction, effectively giving control of the appliance. Essentially every currently supported and many older FortiSIEM releases are affected, spanning versions 4.7 through 7.3.1. Fortinet has confirmed exploit code is being used in the wild, and the flaw carries a high 60.3% EPSS probability of exploitation within 30 days, though it is not yet in CISA's KEV catalog.

Do: Upgrade FortiSIEM to a fixed release per Fortinet's security advisory, ensuring the deployed version falls outside all affected ranges listed above; given in-the-wild exploitation and a ~60% EPSS probability, prioritize externally reachable instances. Until patched, restrict network access to the appliance's CLI/management-facing services and review logs for unexpected commands or connections that may indicate compromise.

9.8

60%

Fortinet FortiSIEM 7.3.0-7.3.1, 7.2.0-7.2.5, 7.1.0-7.1.7, 7.0.0-7.0.3, 6.7.0-6.7.9; 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9, 4.7 (all versions)

largetens of thousands of deployed FortiSIEM instances worldwide (order-of-magnitude estimate)

Aug 12, 2025

Full article461 words · extracted from securityaffairs.com · click to collapse