Loading story…
Fortinet patched CVE-2025-64155, a critical FortiSIEM vulnerability in the phMonitor service that allows unauthenticated remote command and code execution via specially crafted TCP requests to port 7900. The flaw affects multiple FortiSIEM versions from 6.7.0 through 7.4.0 and carries a CVSS 9.8 rating. Researchers said the issue stems from exposed command handlers in phMonitorProcess::initEventHandler and improper sanitization of special characters, allowing attackers to reach an argument-injection path in a curl invocation and gain administrator-level execution on the appliance.
Further analysis showed the attack chain can be extended from admin access to full root compromise by abusing a root cron job that executes a writable file at /opt/charting/redishb.sh. Researchers said the bug was reported to Fortinet in August 2025 after earlier FortiSIEM phMonitor flaws, and Fortinet published its advisory after patching affected branches. Organizations were urged to upgrade immediately to fixed releases or, if patching is not yet possible, restrict exposure of the phMonitor service on TCP port 7900; investigators also noted that verbose logs in /opt/phoenix/log/phoenix.logs may contain indicators of exploitation, including malicious URLs and file-write targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After re-examining the FortiSIEM phMonitor service, researchers identified additional issues enabling full appliance compromise and reported them to Fortinet PSIRT in August 2025. The issues were later assigned CVE-2025-64155.
On 2026-01-13, Fortinet published an advisory for CVE-2025-64155 after patching delays across product branches. The flaw allows unauthenticated remote code and command execution with administrator privileges in the FortiSIEM phMonitor service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed and patched a **critical FortiSIEM OS command injection** vulnerability, **CVE-2025-64155** (CVSS **9.4**), that enables **unauthenticated remote code execution** via crafted TCP/CLI requests to the *phMonitor* service (default **port 7900**). Impact is reported on FortiSIEM **Super and Worker nodes** (Collector nodes reportedly not affected), with recommended upgrades to **7.4.1**, **7.3.5**, or **7.2.7**; a key mitigation is to **restrict network access to port 7900**. Technical analysis described an exploit chain in which attacker-controlled inputs in *phMonitor* requests can be leveraged for **argument injection** leading to **arbitrary file write and code execution** (initially as an admin-level context), followed by a **file overwrite privilege escalation to root**. Public exploit material is reported to be available, and the issue has drawn threat-actor interest (including references in leaked **Black Basta** chats), increasing the likelihood of opportunistic exploitation against exposed FortiSIEM deployments.
Jun 29, 2026
Technical details and public exploit code were released for a **critical Fortinet FortiSIEM** vulnerability, **CVE-2025-25256**, that enables a **remote, unauthenticated attacker** to execute unauthorized OS commands/code via crafted TCP requests. Reporting attributes the issue to exposed command handlers on the `phMonitor` service that can be invoked without authentication, chaining an arbitrary write with elevated permissions and privilege escalation to achieve **root** access. Fortinet has issued patches across affected FortiSIEM versions (reported as impacting **6.7 through 7.5**) and stated that all vulnerable versions are now fixed, following earlier partial fixes across product branches. Researchers noted `phMonitor` has been a recurring entry point for prior FortiSIEM flaws (including **CVE-2023-34992** and **CVE-2024-23108**) and warned that ransomware operators (e.g., **Black Basta**) have previously shown interest in FortiSIEM exploitation, increasing the likelihood of opportunistic targeting now that exploit code is public.
Jun 29, 2026
Researchers disclosed **CVE-2025-25256**, a pre-authentication command injection vulnerability in **Fortinet FortiSIEM** that could allow an unauthenticated attacker to execute commands on exposed systems without logging in first. The issue was detailed by watchTowr Labs and echoed by Summoning Team, both highlighting the risk posed by a flaw in a security monitoring product that is often deployed with broad visibility into enterprise environments. The available reporting identifies the bug as a **pre-auth** attack path with potential for remote exploitation, but the supplied references do not include affected version details, confirmed in-the-wild abuse, or vendor remediation guidance. Even with those gaps, the disclosure raises urgent concern because successful exploitation of a SIEM platform could give attackers a foothold in a high-value security appliance and access to sensitive operational data.
Aug 1, 2026