Critical remote code execution flaw in FortiSIEM actively exploited
Take action: If you have FortiSIEM, block external access to port 7900 until you can update, then plan an urgent patch. Attackers are already exploiting this flaw to take complete control without any login credentials. Since there is a PoC exploit published, this is becoming very urgent.
Learn More
Fortinet is reporting an actively exploited critical security vulnerability in its FortiSIEM platform that allows unauthenticated attackers to execute arbitrary commands.
The vulnerability is tracked as CVE-2025-25256, (CVSS score 9.8) - OS Command Injection- is caused by improper neutralization of special elements used in operating system command enabling attackers to bypass authentication mechanisms and execute unauthorized code on vulnerable FortiSIEM systems.
Security researchers have confirmed that working exploit code has been discovered in active use. Threat actors are already weaponizing this flaw against real-world targets. The exploit code does not appear to produce distinctive indicators of compromise (IoCs), making detection difficult.
Affected FortiSIEM versions:
- 7.3.0 through 7.3.1,
- 7.2.0 through 7.2.5,
- 7.1.0 through 7.1.7,
- 7.0.0 through 7.0.3,
- 6.7.0 through 6.7.9,
- Older branches including 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, and 5.4
Organizations running FortiSIEM versions 6.1 through 6.6 need to migrate to fixed releases. For newer versions there are upgrade paths:
- version 7.3 users should upgrade to 7.3.2 or above,
- version 7.2 users should upgrade to 7.2.6 or above.
- version 7.1 users should upgrade to 7.1.8 or above
- version 7.0 users should upgrade to 7.0.4 or above,
- version 6.7 users should upgrade to 6.7.10 or above
FortiSIEM 7.4, which was released in late July 2025, is not affected.
As a workaround for organizations unable to upgrade immediately, Fortinet recommends limiting access to the phMonitor port 7900 to trusted internal hosts and IP addresses only.
Update - as of 13th of January 2026, Researchers at Horizon3.ai has published a detailed write-up explaining that the root cause of the issue and they released a PoC exploit.
