Fortinet Patches Critical Vulnerabilities in FortiFone, FortiSIEM

SecurityWeek reports that Fortinet has issued patches for six vulnerabilities across its products, including two critical-severity flaws in FortiFone and FortiSIEM. The most severe, CVE-2025-64155 (CVSS 9.4), is an OS command injection in FortiSIEM that could allow unauthenticated code and command execution, mitigated by updates to FortiSIEM versions 7.1.9, 7.2.7, 7.3.5, and 7.4.1, with only the Super and Worker nodes affected according to Fortinet.

The FortiFone flaw, CVE-2025-47855 (CVSS 9.3), could be exploited without authentication to leak device configuration via crafted HTTP or HTTPS requests and was fixed in FortiFone versions 3.0.24 and 7.0.2. Fortinet also fixes CVE-2025-25249 (CVSS 7.4), a heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, with patches in FortiOS versions 7.0.18, 7.2.12, 7.4.9, 7.6.4, FortiSASE 25.2.c, FortiSwitchManager 7.0.6 and 7.2.7, and an upcoming FortiOS 6.4.17.

The company notes further fixes for medium- and low-severity flaws across FortiClientEMS, FortiVoice, and FortiSandbox, and urges users to update promptly, with additional details on Fortinet’s PSIRT advisories according to the advisories page.