Critical Remote Command Injection Vulnerability Affecting Fortinet FortiSIEM
A critical command injection vulnerability has been identified in Fortinet FortiSIEM, enabling an unauthenticated remote attacker to execute arbitrary commands via crafted API requests.
Description
Technical context and vulnerability details
Fortinet FortiSIEM provides unified security information and event management, behavioral analytics, and automated incident response across complex multi-cloud and enterprise infrastructures.
These products are affected by the following vulnerabilities:
CVE-2025-64155: Improper neutralization of special elements used in an OS command (CWE-78) in the supervisor and worker API interfaces. Classified Critical with a CVSS v3.1 base score of 9.4.
Potential Risks & Impact
Potential consequences upon exploitation
- Unauthenticated execution of arbitrary operating system commands;
- Compromise of security information and event management (SIEM) data;
- Tampering with security alerts, event logs, and forensic audit trails.
Affected systems
Products, components and targeted versions
- FortiSIEM 7.3: versions 7.3.0 to 7.3.1;
- FortiSIEM 7.2: versions 7.2.0 to 7.2.2;
- FortiSIEM 7.1: versions 7.1.0 to 7.1.3;
- FortiSIEM 7.0: versions 7.0.0 to 7.0.3;
- FortiSIEM 6.7: versions 6.7.0 to 6.7.8.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately upgrade FortiSIEM to patched versions 7.3.2, 7.2.3, 7.1.4, or 7.0.4 or higher;
- Restrict network access to FortiSIEM management ports to authorized analyst subnets;
- Monitor system logs for abnormal shell execution spawned by web service daemons.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.