Critical FortiSIEM Vulnerability(CVE-2025-64155) Enable Full RCE and Root Compromise

Cybersecuritynews •Guru Baran • January 14, 2026

In August 2025, Fortinet issued an advisory for CVE-2025-25256, an OS command injection vulnerability (CWE-78) in FortiSIEM that exposed the platform to unauthenticated remote code execution via crafted CLI requests. Practical exploits surfaced in the wild, prompting security firm Horizon3.ai to conduct a deep investigation. Their analysis uncovered a devastating chain: an unauthenticated argument injection […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FortiSIEM Vulnerability CVE-2025-64155 Under Active Exploitation A critical vulnerability (CVE-2025-64155) in Fortinet's FortiSIEM platform allows unauthenticated remote code execution via crafted TCP requests. This OS command injection flaw affects the phMonitor service, which is crucial for enterprise security monitoring, and is currently being exploited in the wild. Organizations are urged to apply patches immediately to mitigate risks. 3 sources 75

Extracted Entities

Critical FortiSIEM Vulnerability(CVE-2025-64155) Enable Full RCE and Root Compromise

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Platforms (1)

Vulnerabilities (1)