Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-04 | 2 | General2 |
| 2026-02-12 | 1 | Patch1 |
| 2026-02-20 | 2 | Disclosure2 |
| 2026-05-10 | 1 | Exploit1 |
CVE-2025-64155: Three Years of Remotely Rooting the Fortinet FortiSIEM https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/
Post summary
Researchers announced a PoC that allows remote root on FortiSIEM, indicating that the vulnerability has been actively exploited over the past three years.
GMOサイバー攻撃 ネットde診断 ASM が「FortiSIEM」に存在する深刻な脆弱性「CVE-2025-64155」の検知に対応 https://scan.netsecurity.ne.jp/article/2026/02/05/54562.html?utm_source=twitter&utm_medium=social&utm_content=tweet
Post summary
GMO’s diagnostic ASM announces it will detect the severe FortiSIEM vulnerability CVE-2025-64155, but provides no further technical or exploit details.
CVE-2025-64155 is a critical unauthenticated remote code execution (RCE) vulnerability in Fortinet FortiSIEM, with CVSS scores reported as 9.4 or 9.8. This allows attackers to execute arbitrary code with root privileges via OS command injection flaws like argument injection in phMonitor. #CyberSecurity #Vulnerability ⚠️
Post summary
The post announces a critical RCE vulnerability (CVE‑2025‑64155) in Fortinet FortiSIEM, detailing its CVSS score, impact, and exploitation method.
#VulnerabilityReport Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed https://securityonline.info/fortinet-critical-alert-cve-2025-64155-rce-config-leaks-exposed/?utm_source=dlvr.it&utm_medium=twitter
Post summary
A brief alert announcing a critical RCE vulnerability (CVE-2025-64155) in Fortinet products, but lacking further exploit or remediation details.
Fortinet released fixes for a critical severity ortiSIEM vulnerability (CVE-2025-64155) that stems from improper neutralization of special elements used in OS commands within the phMonitor service (TCP/7900). Learn more in our latest security bulletin. https://livesocial.seismic.com/tuENOO
Post summary
Fortinet has issued a patch for CVE‑2025‑64155, a critical vulnerability in the phMonitor service caused by improper command input sanitization.
GMOサイバー攻撃 ネットde診断 ASM が「FortiSIEM」に存在する深刻な脆弱性「CVE-2025-64155」の検知に対応（ScanNetSecurity） https://news.yahoo.co.jp/articles/9545a8e0c8e10ae4f422b8a34b6ff173eab5c0f1
Post summary
The article reports that GMO’s Netde diagnosis ASM has added detection for CVE-2025-64155 in FortiSIEM, but offers no technical, exploit, or patch details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fortinet | fortisiem | - | - | - |
| App | fortinet | fortisiem | 7.4.0 | - | - |