Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution

Fortinet has released updates to fix a critical FortiSIEM flaw that could let an unauthenticated attacker achieve code execution on affected instances, tracked as CVE-2025-64155 and rated 9.4 out of 10 on the CVSS scale. According to Fortinet, the issue stems from an OS command injection vulnerability that can be exploited via crafted TCP requests, and it affects only Super and Worker nodes, with fixes delivered across multiple FortiSIEM versions via upgrades to fixed releases.

Security researchers, including Horizon3[.]ai’s Zach Hanley who reported the flaw on 14 August 2025, describe two moving parts: an unauthenticated argument injection leading to arbitrary file writes and a file overwrite privilege escalation resulting in root access.

The vulnerability centres on FortiSIEM’s phMonitor service, which handles logging and inter-node communication through port 7900, where certain requests can trigger a shell script with user-controlled parameters, enabling remote code execution and privilege escalation. Fortinet also notes workarounds, such as limiting access to port 7900, and mentions separate fixes for FortiFone CVE-2025-47855 in the same bulletin.