Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed

Fortinet has issued a sweeping set of advisories for its product ecosystem, patching several critical vulnerabilities that could let attackers execute arbitrary code, delete files, or hijack device configurations.

The most severe flaw is CVE-2025-64155, a OS Command Injection in FortiSIEM rated CVSS 9.4, which allows an unauthenticated attacker to run code via crafted TCP requests and specifically affects the Super and Worker nodes, while Collector nodes are reportedly safe; administrators are urged to upgrade to FortiSIEM versions 7.4.1, 7.3.5, or 7.2.7, with a workaround to limit access to the phMonitor port (7900).

FortiOS and FortiSwitch Manager are vulnerable to a heap-based buffer overflow (CVE-2025-25249, CVSS 7.4) that enables remote unauthenticated code execution via the cw_acd daemon, with a workaround to remove ‘fabric’ access from interfaces or block the CAPWAP daemon on ports 5246–5249.

FortiFone Web Portals suffer a critical information disclosure flaw (CVE-2025-47855, CVSS 9.3) allowing unauthenticated access to device configurations via crafted HTTP or HTTPS requests, affecting FortiFone 7.0 and 3.0 and upgrades to 7.0.2 and 3.0.24 respectively.

The advisory list also includes FortiVoice (CVE-2025-58693), FortiClientEMS (CVE-2025-59922) and FortiSandbox (CVE-2025-67685), each with serious impact, and Fortinet has released fixed versions and guidance to apply upgrades via the official upgrade path tool. The article, dated 14 January 2026, emphasises the breadth of the exposure across Fortinet products and the urgent need for immediate remediation.