⚡ Weekly Recap: Fortinet Exploits, Red Line Clipjack, NTLM Crack, Copilot Attack & More

Summary: A critical Fortinet FortiSIEM flaw tracked as CVE-2025-64155, with a CVSS score of 9.4, is under active exploitation in the wild and allows an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests. Horizon3.ai's analysis describes it as an unauthenticated argument injection leading to arbitrary file write and remote code execution as the admin user, plus a file overwrite privilege escalation to root, both in the phMonitor service that runs with elevated privileges.
What you should know: Exploitation of phMonitor grants full control of the appliance, and the recap's wider flaw list spans Cisco, Palo Alto Networks, Microsoft, SAP, ServiceNow, Apache Struts 2 and Node.js - so a single missed update on one internet-facing service is the opening an attacker needs.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-12420 CVE-2025-14301 CVE-2025-14364 CVE-2025-14502 CVE-2025-14894 CVE-2025-20393 CVE-2025-52493 CVE-2025-55131 CVE-2025-55315 CVE-2025-59465 CVE-2025-59466 CVE-2025-64155 CVE-2025-66176 CVE-2025-66177 CVE-2025-68493 CVE-2026-0227 CVE-2026-0491 CVE-2026-0498 CVE-2026-0500 CVE-2026-0501 CVE-2026-20805 CVE-2026-20965 CVE-2026-21859 CVE-2026-22601 CVE-2026-22602 CVE-2026-22603 CVE-2026-22604 CVE-2026-22610 CVE-2026-22689 CVE-2026-23478 CVE-2026-23550
Related: Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow Cyber Risks ·
CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability Known Exploited Vulnerabilities · Jan 13, 2026
CVE-2025-20393: Cisco Multiple Products Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Dec 17, 2025