FortiSIEM Vulnerability CVE-2025-25256: Unauthenticated OS Command Injection Now Active

Fortinet has issued a critical security advisory regarding a high-severity vulnerability in its FortiSIEM platform, identified as CVE-2025-25256. This flaw, which has a CVSS score of 9.8, is a remote, unauthenticated command injection vulnerability that can allow attackers to execute unauthorized code. With evidence of exploit code already circulating in the wild, immediate action is required to protect against potential breaches.

The vulnerability, tracked as FG-IR-25-152, is described as an “improper neutralization of special elements used in an OS command.” This flaw exists within the phMonitor service (TCP port 7900) of the FortiSIEM platform. An unauthenticated attacker can exploit this by sending specially crafted CLI requests to a vulnerable device, leading to the execution of arbitrary commands or code. The exploit does not require user interaction and, according to Fortinet, does not produce distinctive indicators of compromise, making detection difficult.

The vulnerability impacts a wide range of FortiSIEM versions:

• FortiSIEM 5.4
• FortiSIEM 6.1
• FortiSIEM 6.2
• FortiSIEM 6.3
• FortiSIEM 6.4
• FortiSIEM 6.5
• FortiSIEM 6.6
• FortiSIEM 6.7.0 through 6.7.9
• FortiSIEM 7.0.0 through 7.0.3
• FortiSIEM 7.1.0 through 7.1.7
• FortiSIEM 7.2.0 through 7.2.5
• FortiSIEM 7.3.0 through 7.3.1

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code or commands on the affected system. FortiSIEM is a security information and event management (SIEM) platform that organizations use to collect, correlate, and analyze logs, events, and alerts from their IT infrastructure to detect threats and investigate incidents. It is used by a wide range of organizations, including governments, large enterprises, financial institutions, healthcare providers, and managed security service providers (MSSPs). Due to the critical nature of SIEM systems, a successful exploit could have far-reaching consequences, potentially leading to unauthorized access to sensitive data, system compromise, or disruption of critical services.

Notably, Fortinet has stated that exploitation of this flaw does not produce distinctive Indicators of Compromise (IoCs), which makes detecting successful intrusions particularly challenging.

Attackers can exploit CVE-2025-25256 to execute malicious commands by crafting CLI requests, showcasing the following tactics and techniques:

• TA0002 – Execution: Attackers can leverage this vulnerability to execute arbitrary commands on the target system.
• T1203 – Exploitation for Client Execution: By exploiting this vulnerability, attackers can execute malicious code through crafted CLI requests.

Given the severity and active exploitation of CVE-2025-25256, organizations using FortiSIEM are strongly advised to take the following actions:

• Upgrade FortiSIEM: Upgrade to one of the patched versions as soon as possible:
  
• FortiSIEM 6.7.10 or above
• FortiSIEM 7.0.4 or above
• FortiSIEM 7.1.8 or above
• FortiSIEM 7.2.6 or above
• FortiSIEM 7.3.2 or above
• FortiSIEM 7.4 (unaffected)
• Migrate Older Versions: Versions 6.1, 6.2, 6.3, 6.4, 6.5, and 6.6 are also affected but no longer supported. Fortinet recommends migrating to a supported and patched release.
• Limit Access to phMonitor Port: As a temporary workaround, limit access to the phMonitor port (TCP port 7900) to trusted internal hosts/IPs only. This can help reduce the attack surface until a full upgrade can be performed.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.