Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-47855 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. NVD description · AI analysis pending | 9.8 | <1% | — | — | ||
| CVE-2025-64155 | Unauthenticated RCE via OS Command Injection in Fortinet FortiSIEM Fortinet FortiSIEM contains an unauthenticated OS command injection flaw (CWE-78) caused by improper neutralization of special elements used in an OS command. A remote attacker can trigger it by sending crafted TCP requests to the vulnerable service, requiring no credentials or user interaction. Successful exploitation allows execution of unauthorized code or commands on the SIEM host, giving an attacker control over a high-value security monitoring platform. Every current FortiSIEM release branch is affected: 7.4.0, 7.3.0 through 7.3.4, 7.1.0 through 7.1.8, 7.0.0 through 7.0.4, and 6.7.0 through 6.7.10. A public proof-of-concept exploit has been released, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile), though the flaw is not yet in CISA KEV and no confirmed in-the-wild exploitation has been reported. Do: Upgrade FortiSIEM to the fixed release specified in Fortinet's advisory for CVE-2025-64155 as soon as possible, since exploitation requires only network reachability and no authentication. Until patched, restrict access to FortiSIEM's network-facing TCP services (management and event-ingestion interfaces) to trusted management networks and sources. Given the public proof-of-concept and high EPSS score, prioritize checking internet-exposed FortiSIEM instances for signs of exploitation and review logs for unexpected command execution. | 9.8 | 45% | PoC |
| largetens of thousands of FortiSIEM deployments worldwide (all current 6.7.x-7.4.x release branches affected) |
Full article640 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 14, 2026Vulnerability / Patch Management
Fortinet has released updates to fix a critical security flaw impacting FortiSIEM that could allow an unauthenticated attacker to achieve code execution on susceptible instances.
The operating system (OS) injection vulnerability, tracked as CVE-2025-64155, is rated 9.4 out of 10.0 on the CVSS scoring system.
"An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests," the company said in a Tuesday bulletin.
Fortinet said the vulnerability affects only Super and Worker nodes, and that it has been addressed in the following versions -
- FortiSIEM 6.7.0 through 6.7.10 (Migrate to a fixed release)
- FortiSIEM 7.0.0 through 7.0.4 (Migrate to a fixed release)
- FortiSIEM 7.1.0 through 7.1.8 (Upgrade to 7.1.9 or above)
- FortiSIEM 7.2.0 through 7.2.6 (Upgrade to 7.2.7 or above)
- FortiSIEM 7.3.0 through 7.3.4 (Upgrade to 7.3.5 or above)
- FortiSIEM 7.4.0 (Upgrade to 7.4.1 or above)
- FortiSIEM 7.5 (Not affected)
- FortiSIEM Cloud (Not affected)
Horizon3.ai security researcher Zach Hanley, who is credited with discovering and reporting the flaw on August 14, 2025, said it comprises two moving parts -
- An unauthenticated argument injection vulnerability that leads to arbitrary file write, allowing for remote code execution as the admin user
- A file overwrite privilege escalation vulnerability that leads to root access and complete compromise of the appliance
Specifically, the problem has to do with how FortiSIEM's phMonitor service – a crucial backend process responsible for health monitoring, task distribution, and inter-node communication via TCP port 7900 – handles incoming requests related to logging security events to Elasticsearch.
This, in turn, invokes a shell script with user-controlled parameters, thereby opening the door to argument injection via curl and achieving arbitrary file writes to the disk in the context of the admin user.
This limited file write can be weaponized to achieve full system takeover by weaponizing the curl argument injection to write a reverse shell to "/opt/charting/redishb.sh," a file that's writable by an admin user and is executed every minute by the appliance by means of a cron job that runs with root-level permissions.
In other words, writing a reverse shell to this file enables privilege escalation from admin to root, granting the attacker unfettered access to the FortiSIEM appliance. The most important aspect of the attack is that the phMonitor service exposes several command handlers that do not require authentication. This makes it easy for an attacker to invoke these functions simply by obtaining network access to port 7900.
Fortinet has also shipped fixes for another critical security vulnerability in FortiFone (CVE-2025-47855, CVSS score: 9.3) that could allow an unauthenticated attacker to obtain device configuration via a specially crafted HTTP(S) request to the Web Portal page. It impacts the following versions of the enterprise communications platform -
- FortiFone 3.0.13 through 3.0.23 (Upgrade to 3.0.24 or above)
- FortiFone 7.0.0 through 7.0.1 (Upgrade to 7.0.2 or above)
- FortiFone 7.2 (Not affected)
Users are advised to update to the latest versions for optimal protection. As workarounds for CVE-2025-64155, Fortinet is recommending that customers limit access to the phMonitor port (7900).
PoC Released
Horizon3.ai has also made available a proof-of-concept (PoC) exploit for CVE-2025-64155, demonstrating how it could be leveraged by a remote, unauthenticated attacker to execute arbitrary code and seize control of an appliance.
Exploitation Efforts Detected
Defused Cyber, in a post shared on X on January 15, 2026, said it has observed targeted exploitation of CVE-2025-64155 against its honeypots, with the attacks originating from no less than six unique IP addresses -
- 167.17.179[.]109
- 103.224.84[.]76
- 209.126.11[.]25
- 120.231.127[.]227
- 129.226.190[.]169
- 220.181.41[.]80
(The story was updated after publication to reflect the latest developments.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/fortinet-fixes-critical-fortisiem-flaw.html