Back Feeds2.Feedburner

PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155)

Feeds2.Feedburner •Zeljka Zorz • January 15, 2026

A critical vulnerability (CVE-2025-64155) in Fortinet’s FortiSIEM security platform has now been accompanied by publicly released proof-of-concept (PoC) exploit code, raising the urgency for organizations to patch immediately. CVE-2025-64155 CVE-2025-64155 may allow unauthenticated, remote attackers to execute unauthorized code or commands on vulnerable FortiSIEM deployments via specially crafted TCP requests. “This flaw targets the phMonitor service, the ‘nervous system’ of the SIEM, allowing attackers to write arbitrary code into a file executed as the … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FortiSIEM Vulnerability CVE-2025-64155 Under Active Exploitation A critical vulnerability (CVE-2025-64155) in Fortinet's FortiSIEM platform allows unauthenticated remote code execution via crafted TCP requests. This OS command injection flaw affects the phMonitor service, which is crucial for enterprise security monitoring, and is currently being exploited in the wild. Organizations are urged to apply patches immediately to mitigate risks. 3 sources 75

Extracted Entities

CVEs (1)

CVE-2025-64155

Platforms (1)

FortiSIEM