InfoSecBulletin Cybersecurity for mankind
A critical Fortinet FortiSIEM vulnerability with publicly available proof-of-concept exploit code is now being abused in attacks.
Security researcher Zach Hanley from Horizon3.ai reported vulnerability CVE-2025-64155, which combines two issues that enable arbitrary writes with admin permissions and privilege escalation to root access.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
“An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests,” Fortinet explained on Tuesday, when it released security updates to patch the flaw.
Horizon3.ai released a technical report identifying that the problem is due to many command handlers in the phMonitor service being accessed remotely without authentication. They provided proof-of-concept exploit code that can achieve root code execution by using argument injection to overwrite the /opt/charting/redishb.sh file.
The flaw exists in FortiSIEM versions 6.7 to 7.5, which can be fixed by upgrading to FortiSIEM 7.4.1 or later, 7.3.5 or later, 7.2.7 or later, or 7.1.9 or later. Users of FortiSIEM 7.0.0 to 7.0.4 and 6.7.0 to 6.7.10 should upgrade to a secure version.
On Tuesday, Fortinet also shared a temporary workaround for admins who can’t immediately apply security updates, requiring them to limit access to the phMonitor port (7900).
Defused reported that threat actors are actively exploiting the CVE-2025-64155 flaw in the wild two days later.
“Fortinet FortiSIEM vulnerability CVE-2025-64155 is experience active, targeted exploitation in our honeypots,” Defused warned.
Horizon3.ai offers indicators of compromise to aid defenders in spotting compromised systems. Researchers noted that admins can look for signs of malicious activity by reviewing the phMonitor message logs at /opt/phoenix/log/phoenix.logs, specifically for payload URLs associated with PHL_ERROR entries.
Fortinet has yet to update its security advisory and flag the vulnerability as exploited in attacks as reported by BleepingComputer.
