Attacks Target Freshly Patched Critical Fortinet Flaws
Take action: This became urgent. FortiSIEM is actively attacked. Patch your FortiSIEM appliances to the latest version immediately and block port 7900 from any public access.
Learn More
The Fortinet FortiSIEM flaw, CVE-2025-64155 (CVSS score 9.8) is reported to be actively exploited. The vulnerability is a OS command injection flaw in FortiSIEM that allows unauthenticated remote code execution via port 7900.
Researchers at Defused report attacks right after the patch came out. These groups use IP addresses from China Mobile and Tencent to find targets.
The bug affects FortiSIEM versions 6.7 to 7.5.
Users should update to versions 7.4.1, 7.3.5, 7.2.7, or 7.1.9. Fortinet will not release fixes for versions 6.7.x or 7.0.x. If you use those, you must switch to a newer release. If you cannot update yet, block port 7900 to stop the exploit.
