A critical vulnerability in Fortinet’s FortiSIEM allows remote attackers to execute unauthorized commands, with technical details and a public exploit now available. Fortinet has patched the flaw across most supported versions, but unpatched systems remain at risk. #CVE-2025-25256 #FortinetSIEM
Keypoints
- The vulnerability CVE-2025-25256 involves improper OS command neutralization, enabling remote code execution.
- Researchers from Horizon3.ai released a detailed write-up and a demonstrative exploit for the flaw.
- The security flaw impacts FortiSIEM versions 6.7 to 7.5, with patches available for several versions.
- Fortinet recommends limiting access to the phMonitor port as a workaround when immediate patching isn’t possible.
- Multiple past vulnerabilities in FortiSIEM, like CVE-2023-34992, highlight ongoing security concerns with this product.