Fortinet FortiSIEM Vulnerability CVE-2025

Cybersecuritynews •Guru Baran • January 15, 2026

Fortinet FortiSIEM vulnerability CVE-2025-64155 is under active exploitation, as confirmed by Defused through their honeypot deployments. This critical OS command injection flaw enables unauthenticated remote code execution, posing severe risks to enterprise security monitoring systems. CVE-2025-64155 stems from improper neutralization of special elements in OS commands within the FortiSIEM phMonitor service, which handles internal data […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FortiSIEM Vulnerability CVE-2025-64155 Under Active Exploitation A critical vulnerability (CVE-2025-64155) in Fortinet's FortiSIEM platform allows unauthenticated remote code execution via crafted TCP requests. This OS command injection flaw affects the phMonitor service, which is crucial for enterprise security monitoring, and is currently being exploited in the wild. Organizations are urged to apply patches immediately to mitigate risks. 3 sources 75

Extracted Entities

Fortinet FortiSIEM Vulnerability CVE-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)