InfoSecBulletin Cybersecurity for mankind
A critical Fortinet FortiSIEM vulnerability with publicly available proof-of-concept exploit code is now being abused in attacks.
Security researcher Zach Hanley from Horizon3.ai reported vulnerability CVE-2025-64155, which combines two issues that enable arbitrary writes with admin permissions and privilege escalation to root access.
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548Â
Gartner
70% of SOCs Will Pilot AI Agents: Only 15% Will See Results
CVE-2026-62911
Nearly 22,000 Microsoft Exchange Servers are vulnerable to attack
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
“An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests,” Fortinet explained on Tuesday, when it released security updates to patch the flaw.
Horizon3.ai released a technical report identifying that the problem is due to many command handlers in the phMonitor service being accessed remotely without authentication. They provided proof-of-concept exploit code that can achieve root code execution by using argument injection to overwrite the /opt/charting/redishb.sh file.
The flaw exists in FortiSIEM versions 6.7 to 7.5, which can be fixed by upgrading to FortiSIEM 7.4.1 or later, 7.3.5 or later, 7.2.7 or later, or 7.1.9 or later. Users of FortiSIEM 7.0.0 to 7.0.4 and 6.7.0 to 6.7.10 should upgrade to a secure version.
On Tuesday, Fortinet also shared a temporary workaround for admins who can’t immediately apply security updates, requiring them to limit access to the phMonitor port (7900).
Defused reported that threat actors are actively exploiting the CVE-2025-64155 flaw in the wild two days later.
“Fortinet FortiSIEM vulnerability CVE-2025-64155 is experience active, targeted exploitation in our honeypots,” Defused warned.
Horizon3.ai offers indicators of compromise to aid defenders in spotting compromised systems. Researchers noted that admins can look for signs of malicious activity by reviewing the phMonitor message logs at /opt/phoenix/log/phoenix.logs, specifically for payload URLs associated with PHL_ERROR entries.
Fortinet has yet to update its security advisory and flag the vulnerability as exploited in attacks as reported by BleepingComputer.
