Cyber: Hackers Now Exploiting Critical Fortinet Fortisiem Flaw In Attacks

A critical Fortinet FortiSIEM vulnerability with publicly available proof-of-concept exploit code is now being abused in attacks.

According to security researcher Zach Hanley at penetration testing company Horizon3.ai, who reported the vulnerability (CVE-2025-64155), it is a combination of two issues that allow arbitrary writes with admin permissions and privilege escalation to root access.

"An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests," Fortinet explained on Tuesday, when it released security updates to patch the flaw.

Horizon3.ai has published a technical write-up explaining that the root cause of the issue is the exposure of dozens of command handlers on the phMonitor service, which can be invoked remotely without authentication, and it released proof-of-concept exploit code that allows gaining code execution as root by abusing an argument injection to overwrite the /opt/charting/redishb.sh file.

The flaw affects FortiSIEM versions 6.7 to 7.5 and can be patched by upgrading to FortiSIEM 7.4.1 or later, 7.3.5 or later, 7.2.7 or later, or 7.1.9 or later. Customers using FortiSIEM 7.0.0 through 7.0.4 and FortiSIEM 6.7.0 through 6.7.10 are advised to migrate to a fixed release.

On Tuesday, Fortinet also shared a temporary workaround for admins who can't immediately apply security updates, requiring them to limit access to the phMonitor port (7900).

Two days later, threat intelligence firm Defused reported that threat actors are now actively exploiting the CVE-2025-64155 flaw in the wild.

"Fortinet FortiSIEM vulnerability CVE-2025-64155 is experience active, targeted exploitation in our honeypots," Defused warned.

​Horizon3.ai also provides indicators of compromise to help defenders identify already compromised systems. As the researchers explained, admins can find evidence of malicious abuse by checking the phMonitor message logs at /opt/phoenix/log/phoenix.logs for payload URLs on lines that contain PHL_ERROR entries.

Fortinet has yet to update its security advisory and flag the vulnerability as exploited in attacks. BleepingComputer also reached out to a Fortinet spokesperson to confirm the reports of active exploitation, but a response was not immediately available.

Source: BleepingComputer