Critical Fortinet FortiSIEM Vulnerability (CVE-2025-64155) Disclosed

THE THREAT

On January 13, 2026, Fortinet disclosed a critical vulnerability affecting multiple versions of FortiSIEM. The vulnerability, tracked as CVE-2025-64155 (CVSS: 9.4), is an OS command injection flaw caused by improper neutralization of special elements within OS commands. This allows an unauthenticated attacker to execute arbitrary code or commands through specially crafted TCP requests. Successful exploitation of the flaw could result in full compromise of the affected device.

CVE-2025-64155 was reported to Fortinet by Horizon3.ai, which also released a Proof-of-Concept (PoC) exploit on the day of public disclosure. At the time of writing, there is no evidence indicating active exploitation in the wild. However, given that the vulnerability can be exploited without authentication, leads to Remote Code Execution (RCE), and has publicly available exploit code, it is critical for the organizations to apply the relevant security updates immediately to mitigate the risk of exploitation.

What we're doing about it

• eSentire's Threat Response Unit (TRU) team created new MDR for Network detections to identify exploitation attempts
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Fortinet
• If patching is not possible, Fortinet recommends limiting access to the phMonitor port (7900)

Additional information

The vulnerability exists in the phMonitor service of FortiSIEM, specifically within the elastic_test_url.sh script. The script allows user-controlled input to be passed to a CURL command, making it possible to write files to arbitrary locations. This can be leveraged by an attacker to achieve RCE. Horizon3.ai analysis showed that argument injection into the CURL command is possible and writes arbitrary content to arbitrary locations with administrative privileges. This vulnerability affects only the Super and Worker nodes of FortiSIEM and does not impact Collector nodes. FortiSIEM Cloud and FortiSIEM 7.5 versions remain unaffected by the flaw.

Horizon3.ai demonstrated exploitation of the vulnerability by writing a reverse shell to an already existing file that is executed periodically on the FortiSIEM server. The attack was further extended by writing a reverse shell to a binary that runs every minute, which enabled privilege escalation from the admin user to root, ultimately resulting in full compromise of the server. The log file located at /opt/phoenix/log/phoenix.log can be used to investigate potential exploitation of this vulnerability, as it records the contents of messages received by the phMonitor service. The PoC exploit code for CVE-2025-64155 has been published in Horizon3.ai's GitHub repository.

While CVE-2025-64155 is not yet reported to be exploited in the wild, vulnerabilities in Fortinet appliances have a history of being targeted by threat actors. eSentire Threat Intelligence team tracks vulnerabilities in Fortinet and assesses that exploitation of CVE-2025-64155 by threat actors is likely in the immediate future. Given the severity of the vulnerability and availability of PoC exploit code, organizations are recommended to patch vulnerable instances as soon as possible.

References:

[1] https://www.fortiguard.com/psirt/FG-IR-25-772
[2] https://www.cve.org/CVERecord?id=CVE-2025-64155
[3] https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/
[4] https://github.com/horizon3ai/CVE-2025-64155