CVE-2025-64155
Fortinet FortiSIEM OS Command Injection
Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
INFO
Published Date :
Jan. 13, 2026, 5:15 p.m.
Last Modified :
Jan. 20, 2026, 4:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 6abe59d8-c742-4dff-8ce8-9b0ca1073da8 | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update FortiSIEM to a patched version.
- Apply vendor-supplied security updates.
- Monitor network traffic for suspicious requests.
Public PoC/Exploit Available at Github
CVE-2025-64155 has a 4 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-64155.
| URL | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-25-772 | Vendor Advisory |
| https://github.com/horizon3ai/CVE-2025-64155 | Exploit Third Party Advisory |
| https://github.com/purehate/CVE-2025-64155-hunter |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-64155 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-64155
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2025-64155
Authorized high-impact tool from CYBERDUDEBIVASH ECOSYSTEM to detect CVE-2025-64155 (FortiSIEM phMonitor Command Injection). Scans for open ports and vulnerable behaviors ethically.
Python
CVE-2025-64155-hunter
Python
CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-64155 vulnerability anywhere in the article.
-
europa.eu
Cyber Brief 26-02 - January 2026
Cyber Brief (January 2026)February 2, 2026 – Version: 1TLP:CLEARExecutive summaryWe analysed 268 open source reports for this Cyber Security Brief.1Relating to cyber policy, The European Commission pr ... Read more
-
Help Net Security
Week in review: PoC for FortiSIEM flaw released, Rakuten Viber CISO/CTO on messaging risks
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What security teams can learn from torrent metadata Security teams often spend time sorting through lo ... Read more
-
Help Net Security
Cisco fixes AsyncOS vulnerability exploited in zero-day attacks (CVE-2025-20393)
Cisco has finally shipped security updates for its Email Security Gateway and Secure Email and Web Manager devices, which fix CVE-2025-20393, a vulnerability in the devices’ AsyncOS that has been expl ... Read more
-
security.nl
'Aanvallers maken actief misbruik van kritiek lek in Fortinet FortiSIEM'
Aanvallers maken actief misbruik van een kritieke kwetsbaarheid in Fortinet FortiSIEM waarvoor op 13 januari beveiligingsupdates verschenen, zo meldt securitybedrijf Defused. FortiSIEM is een Security ... Read more
-
TheCyberThrone
Cisco Finaly Patches Critical AsyncOS Zero-Day: CVE-2025-20393
January 16, 2026Cisco has released patches for a maximum-severity AsyncOS vulnerability (CVE-2025-20393) that was actively exploited by a China-linked APT group since November 2025. The flaw, carrying ... Read more
-
BleepingComputer
Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks
A critical Fortinet FortiSIEM vulnerability with publicly available proof-of-concept exploit code is now being abused in attacks. According to security researcher Zach Hanley at penetration testing co ... Read more
-
Help Net Security
Ransomware activity never dies, it multiplies
Ransomware attacks kept climbing through 2025, even as major criminal groups collapsed and reformed. A new study conducted by the Symantec and Carbon Black Threat Hunter Team shows that disruption ins ... Read more
-
CybersecurityNews
Fortinet FortiSIEM Vulnerability CVE-2025-64155 Actively Exploited in Attacks
Fortinet FortiSIEM vulnerability CVE-2025-64155 is under active exploitation, as confirmed by Defused through their honeypot deployments. This critical OS command injection flaw enables unauthenticat ... Read more
-
Help Net Security
PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155)
A critical vulnerability (CVE-2025-64155) in Fortinet’s FortiSIEM security platform has now been accompanied by publicly released proof-of-concept (PoC) exploit code, raising the urgency for organizat ... Read more
-
BleepingComputer
Exploit code public for critical FortiSIEM command injection flaw
Technical details and a public exploit have been published for a critical vulnerability affecting Fortinet's Security Information and Event Management (SIEM) solution that could be leveraged by a remo ... Read more
-
CybersecurityNews
New One-Click Microsoft Copilot Vulnerability Grants Attackers Undetected Access to Sensitive Data
A novel single-click attack targeting Microsoft Copilot Personal that enables attackers to silently exfiltrate sensitive user data. The vulnerability, now patched, allowed threat actors to hijack sess ... Read more
-
CybersecurityNews
Critical FortiSIEM Vulnerability(CVE-2025-64155) Enable Full RCE and Root Compromise
In August 2025, Fortinet issued an advisory for CVE-2025-25256, an OS command injection vulnerability (CWE-78) in FortiSIEM that exposed the platform to unauthenticated remote code execution via craft ... Read more
-
TheCyberThrone
CVE-2025-64155 – Critical RCE in Fortinet FortiSIEM
January 14, 2026Fortinet patched a severe unauthenticated remote command injection flaw in FortiSIEM on January 13, 2026, tracked as CVE-2025-64155 with CVSS 9.4.Discovered by Horizon3.ai in August 20 ... Read more
-
The Hacker News
Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution
Jan 14, 2026Ravie LakshmananVulnerability / Patch Management Fortinet has released updates to fix a critical security flaw impacting FortiSIEM that could allow an unauthenticated attacker to achieve ... Read more
-
CybersecurityNews
Critical FortiSIEM Vulnerability Lets Attackers Run Arbitrary Commands via TCP Packets
Fortinet disclosed a critical OS command injection vulnerability in FortiSIEM on January 13, 2026, warning users of a high-risk flaw that lets unauthenticated attackers execute arbitrary code. Tracked ... Read more
-
The Cyber Express
MS-ISAC Flags High-Risk Security Flaws in Fortinet Products
A new cybersecurity advisory from the Multi-State Information Sharing and Analysis Center (MS-ISAC) is alerting organizations to multiple vulnerabilities affecting Fortinet products, some of which cou ... Read more
-
Daily CyberSecurity
Critical SAP Alert: S/4HANA SQL Injection & Wily RCE Threaten Financial Data
SAP administrators are facing a busy start to the year. On January 13, 2026, the enterprise software giant released 17 new security notes, addressing a raft of vulnerabilities that could expose critic ... Read more
-
Daily CyberSecurity
Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed
Fortinet has issued a sweeping set of security advisories, patching critical vulnerabilities across its product ecosystem that could allow attackers to execute arbitrary code, delete files, or hijack ... Read more
The following table lists the changes that have been made to the
CVE-2025-64155 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jan. 20, 2026
Action Type Old Value New Value Added Reference https://github.com/purehate/CVE-2025-64155-hunter -
Initial Analysis by [email protected]
Jan. 14, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 6.7.0 up to (excluding) 7.1.9 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.2.0 up to (excluding) 7.2.7 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.3.5 *cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:* Added Reference Type Fortinet, Inc.: https://fortiguard.fortinet.com/psirt/FG-IR-25-772 Types: Vendor Advisory Added Reference Type CISA-ADP: https://github.com/horizon3ai/CVE-2025-64155 Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jan. 13, 2026
Action Type Old Value New Value Added Reference https://github.com/horizon3ai/CVE-2025-64155 -
New CVE Received by [email protected]
Jan. 13, 2026
Action Type Old Value New Value Added Description An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-25-772