Critical FortiSIEM Flaw Under Active Exploitation, Fortinet Warns

Fortinet has issued a critical alert about a previously unknown vulnerability in their FortiSIEM security information and event management (SIEM) solution, which is currently being actively exploited in the wild. The vulnerability, tracked as CVE-2025-25256, carries a high Severity Rating of 9.8 on the Common Vulnerability Scoring System (CVSS), making it a top priority for Fortinet customers to address immediately.

The flaw is an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary code or commands via crafted CLI requests. This type of attack can potentially lead to unauthorized access, data breaches, and other malicious activities if left unchecked.

According to Fortinet's advisory, the vulnerability is caused by an improper neutralization of special elements used in the operating system command (CWE-78). This flaw leaves no clear Indicators of Compromise (IoCs), making it challenging for security professionals to detect and respond to the attacks in a timely manner.

Fortinet has confirmed that practical exploit code for this vulnerability was found in the wild, indicating that attackers are already taking advantage of the weakness. It is essential for FortiSIEM customers to take immediate action to mitigate the risk posed by this vulnerability.

The affected versions of FortiSIEM include 7.4, while later versions are not impacted by the flaw. To work around the vulnerability, Fortinet recommends limiting access to the phMonitor port (7900) to prevent unauthorized access and potential exploitation.

As a leading security expert, it is crucial for organizations that use FortiSIEM to take proactive measures to secure their systems against this critical vulnerability. This includes ensuring that all software is up-to-date, implementing robust access controls, and regularly monitoring system logs for signs of malicious activity.

Stay Informed, Stay Safe

If you are concerned about the impact of this vulnerability on your organization's security posture, I encourage you to follow Fortinet's recommendations for mitigation and patching. Additionally, stay tuned for further updates and alerts from reputable sources in the cybersecurity community.

For the latest news and insights on cybersecurity threats and vulnerabilities, follow me on Twitter: @securityaffairs and Facebook, as well as Mastodon, where I will continue to provide timely and informative updates on the world of cybersecurity.