Fortinet Patches Critical FortiSIEM Command Injection Vulnerability (CVE-2025-64155)

Fortinet has released security updates to fix a critical vulnerability (CVE-2025-64155) in FortiSIEM that could allow an unauthenticated remote attacker to execute arbitrary commands on affected systems. The flaw exists in a core FortiSIEM service responsible for internal communication and system monitoring functions.

The vulnerability is caused by improper handling of user-supplied input passed to operating system command execution routines. A network-accessible service listens on a dedicated management port and processes requests without sufficient validation. By sending a specially crafted request, an attacker can inject arbitrary command strings that are executed by the underlying operating system with elevated privileges.

Successful exploitation grants direct command execution on the FortiSIEM appliance. Because FortiSIEM runs with extensive permissions and performs scheduled tasks as a privileged user, an attacker can escalate access further, achieve persistence, and fully compromise the platform. This is particularly concerning given FortiSIEM’s role in collecting, correlating, and storing security telemetry across enterprise environments.

A compromised FortiSIEM instance can be used to disable monitoring, manipulate logs, or conceal malicious activity elsewhere in the network. The exposure of this system undermines the integrity of security operations and incident response capabilities.

Fortinet has addressed the issue in updated FortiSIEM versions and recommends immediate patching. Organizations that cannot apply updates right away should restrict network access to the affected service and review logs for signs of abnormal interaction. Verifying system integrity after patching is also strongly advised.

This vulnerability highlights the continued risk posed by command injection flaws in security infrastructure components and reinforces the need to tightly control network exposure and apply updates without delay.