CVE-2025-64155: FortiSIEM OS command injection via crafted TCP requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit code plus very high EPSS make this an urgent patching priority.

What it is

FortiSIEM contains an OS command injection flaw (CWE-78) reachable through crafted TCP requests. Multiple 6.7.x through 7.4.0 branches are affected, and the vulnerability allows unauthenticated remote code execution, making it a serious risk for exposed management or service interfaces.

Impact

An attacker can execute unauthorized code or commands on the FortiSIEM host, potentially gaining full control of the appliance and any data or credentials it processes.

Attack surface

The flaw is network-reachable (AV:N) with no authentication (PR:N) and no user interaction (UI:N), triggered by crafted TCP requests to the affected service. Any FortiSIEM instance with the relevant interface exposed to untrusted networks is at risk.

Exploitation

Not listed in CISA KEV, but public exploit code exists (GitHub references tagged Exploit) and EPSS is 0.45427 (98.7th percentile), indicating high likelihood of active exploitation.

What to do

• Apply the Fortinet PSIRT FG-IR-25-772 firmware update for your FortiSIEM branch (7.4.0, 7.3.0-7.3.4, 7.1.0-7.1.8, 7.0.0-7.0.4, 6.7.0-6.7.10).
• Restrict network access to FortiSIEM management and service ports to trusted hosts only; do not expose them to the internet.
• Monitor Fortinet PSIRT advisory for updated fixed versions and interim workarounds.
• Segment FortiSIEM from other critical systems to limit lateral movement if compromised.
• Audit for signs of compromise and rotate credentials stored or processed by the appliance.

Detection

• Inspect FortiSIEM and host logs for unexpected child processes spawned by the FortiSIEM service, especially shell or command interpreters.
• Monitor network traffic for anomalous TCP requests to FortiSIEM service ports from untrusted sources.
• Use EDR or process monitoring to alert on command execution originating from FortiSIEM application processes.
• Review authentication and access logs for unusual activity on FortiSIEM management interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.