Feeds2.Feedburner

Critical FortiSIEM Vulnerability CVE-2025-64155 Under Active Exploitation

First seen 17 Jan 2026, 05:01 UTC • Cybersecuritynews

•71% similarity •74.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical vulnerability (CVE-2025-64155) in Fortinet's FortiSIEM platform allows unauthenticated remote code execution via crafted TCP requests. This OS command injection flaw affects the phMonitor service, which is crucial for enterprise security monitoring, and is currently being exploited in the wild. Organizations are urged to apply patches immediately to mitigate risks.

ThreatCluster AI

Attack Flow

8 entities, 11 inferred relationships (STIX 2.1).

Technique (2)

Zero-day Exploit
T1059 - Command and Scripting Interpreter

Organization (1)

Fortinet

Vulnerability (3)

CVE-2025-25256
CVE-2025-64155
OS Command Injection

Affected Platform (2)

FortiSIEM
PhMonitor

Relationships

CVE-2025-25256 targets FortiSIEM
CVE-2025-25256 targets PhMonitor
CVE-2025-64155 targets FortiSIEM
CVE-2025-64155 targets PhMonitor
OS Command Injection targets FortiSIEM
OS Command Injection targets PhMonitor
Zero-day Exploit targets FortiSIEM
Zero-day Exploit targets PhMonitor
T1059 - Command and Scripting Interpreter targets FortiSIEM
T1059 - Command and Scripting Interpreter targets PhMonitor
CVE-2025-25256 related to Fortinet

Community

Browse all →

Critical FortiSIEM Vulnerability CVE-2025-64155 Under Active Exploitation

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading