CVE-2025-64155
Published: 13 January 2026
Summary
CVE-2025-64155 is a critical-severity OS Command Injection (CWE-78) vulnerability in Fortinet Fortisiem. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-64155 is an OS command injection vulnerability (CWE-78) affecting Fortinet FortiSIEM versions 7.4.0, 7.3.0 through 7.3.4, 7.1.0 through 7.1.8, 7.0.0 through 7.0.4, and 6.7.0 through 6.7.10. It stems from improper neutralization of special elements in OS commands, enabling attackers to execute unauthorized code or commands through crafted TCP requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact on confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary command execution on the affected FortiSIEM system, potentially leading to full system compromise, data exfiltration, or further lateral movement within the environment.
Mitigation details are outlined in the Fortinet PSIRT advisory (FG-IR-25-772). Proof-of-concept exploit code and detection tools are available in public GitHub repositories from horizon3ai and purehate.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2076
Vulnerability details
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to…
more
execute unauthorized code or commands via crafted TCP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection RCE in public-facing FortiSIEM service enables T1190 for initial access and T1059.004 for Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific OS command injection flaw in FortiSIEM, directly preventing exploitation via vendor patching as noted in the advisory.
Mandates validation of information inputs from crafted TCP requests, directly addressing improper neutralization of special elements to block OS command injection.
Enforces boundary protections to monitor and control TCP communications to the vulnerable FortiSIEM service, reducing exposure to unauthenticated remote attacks.