Critical Vulnerability in FortiSIEM

Background

Fortinet has released security updates addressing a critical vulnerability (CVE-2025-25256) affecting their FortiSIEM products.

Impact

Successful exploitation of this operating system (OS) command vulnerability could allow an unauthenticated attacker to execute unauthorised code or commands via specially crafted command-line interface (CLI) requests.This vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10.

Affected Products

The vulnerability affects the following products:

• FortiSIEM 6.1, 6.2, 6.3, 6.4, 6.5, 6.6 

• FortiSIEM 6.7.0 through 6.7.9

• FortiSIEM 7.0.0 through 7.0.3

• FortiSIEM 7.1.0 through 7.1.7

• FortiSIEM 7.2.0 through 7.2.5

• FortiSIEM 7.3.0 through 7.3.1

Known Exploitation

Exploit code for this vulnerability is reportedly available.

Mitigation

Users and administrators of affected product versions are advised to update to the latest versions immediately. 

If updating is not feasible, users are recommended to limit access to the phMonitor port (7900).

References

https://www.fortiguard.com/psirt/FG-IR-25-152

https://nvd.nist.gov/vuln/detail/CVE-2025-25256

https://thehackernews.com/2025/08/fortinet-warns-about-fortisiem.html