More Problems for Fortinet: Critical FortiSIEM Flaw Exploited

Fortinet customers faced a fresh and highly serious vulnerability early in 2026, with FortiSIEM flagged as CVE-2025-64155, a command injection flaw that carries a 9.4 CVSS score and enables unauthenticated remote code execution through crafted TCP requests. On 13 January, Fortinet disclosed the flaw, and by 16 January Dark Reading reported that exploitation had begun in the wild, with activity traced to multiple IP addresses, including three from Chinese providers.

Exploitation appears to have been influenced by Horizon3’s PoC exploit, and researchers have noted that the phMonitor service at FortiSIEM is involved in the issue, exposing command handlers that can be abused without authentication. Fortinet has urged customers to update FortiSIEM versions 6.7 through 7.4 to a fixed release and, as a temporary mitigation, to limit access to phMonitor via port 7900.

Kohonen of Defused notes that exploitation activity has expanded to roughly 15 differentiated actors and that the flaw has drawn above-average attention compared with other critical exploits. According to Horizon3, the vulnerability stems from earlier security gaps associated with phMonitor, which monitors FortiSIEM’s processes and directs requests to handlers.