Fortinet warns of FortiSIEM remote code execution flaw CVE-2025-25256

Fortinet has issued a critical security advisory for FortiSIEM after exploit code for a remote OS command injection flaw surfaced in the wild. The vulnerability, tracked as CVE202525256, could allow unauthenticated attackers to execute arbitrary code or commands through crafted command-line interface requests. Fortinet says the flaw affects multiple FortiSIEM branches, with patches available in the latest supported releases and a recommended workaround to limit access to the phMonitor service port 7900 if a rapid upgrade is not feasible. Officials emphasize that the exploit code in circulation does not appear to yield distinctive indicators of compromise, complicating detection for defenders.

Fortinet’s advisory describes the weakness as an improper neutralization of special elements in OS commands, a vulnerability class that enables privilege escalation and remote code execution via the phMonitor pathway used by internal FortiSIEM components to perform discovery and synchronization tasks. While Fortinet did not publicly discuss active exploitation, the firm stresses that practical exploit code exists in the wild, underscoring the urgency for administrators to apply updates....