Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution
Summary: Fortinet released updates for a critical OS command injection flaw in FortiSIEM, tracked as CVE-2025-64155 and rated 9.4 on CVSS, that lets an unauthenticated attacker execute unauthorized code or commands via crafted TCP requests. Researcher Zach Hanley of Horizon3.ai, credited with reporting the flaw on August 14, 2025, described a chain through the phMonitor service on TCP port 7900 that uses curl argument injection to write a reverse shell to /opt/charting/redishb.sh, a file run every minute by a root-level cron job, escalating admin to root.
What's compelling: Defused Cyber reported on January 15, 2026 that it observed targeted exploitation of CVE-2025-64155 against its honeypots from at least six unique IP addresses, and a public proof-of-concept exploit is already available. The only workaround Fortinet offers is limiting access to port 7900, so any FortiSIEM Super or Worker node reachable on that port is exposed to an unauthenticated attacker.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-47855CVE-2025-64155
- Related
- ⚡ Weekly Recap: Fortinet Exploits, Red Line Clipjack, NTLM Crack, Copilot Attack & More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026