Fortinet fixed two critical flaws in FortiFone and FortiSIEM
January 14, 2026
Fortinet fixed six security flaws, including two critical bugs in FortiFone and FortiSIEM that attackers could exploit without authentication.
Fortinet released patches for six vulnerabilities, including two critical flaws in FortiFone and FortiSIEM that could be exploited without authentication to leak configuration data or enable code execution.
The first vulnerabilty, tracked as CVE-2025-64155 (CVSS score of 9.4), is an improper neutralization of special elements used in an OS command that could led to OS Command Injection. The vulnerability impacts FortiSIEM, an unauthenticated attacker can trigger the issue to execute unauthorized code or commands via crafted TCP requests.
“An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests.” reads the advisory.
The flaw impacts the following versions:
| Version | Affected | Solution |
|---|---|---|
| FortiSIEM Cloud | Not affected | Not Applicable |
| FortiSIEM 7.5 | Not affected | Not Applicable |
| FortiSIEM 7.4 | 7.4.0 | Upgrade to 7.4.1 or above |
| FortiSIEM 7.3 | 7.3.0 through 7.3.4 | Upgrade to 7.3.5 or above |
| FortiSIEM 7.2 | 7.2.0 through 7.2.6 | Upgrade to 7.2.7 or above |
| FortiSIEM 7.1 | 7.1.0 through 7.1.8 | Upgrade to 7.1.9 or above |
| FortiSIEM 7.0 | 7.0.0 through 7.0.4 | Migrate to a fixed release |
| FortiSIEM 6.7 | 6.7.0 through 6.7.10 | Migrate to a fixed release |
The researcher Zach Hanley (@hacks_zach) of Horizon3.ai reported the vulnerability.
The vulnerability only impacts the Super and Worker nodes, it does not impact Collector nodes. The vendor recommends limiting access to the phMonitor port (7900) as workaround.
The second critical flaw, tracked as CVE-2025-47855 (CVSS score of 9.3), addressed by Fortinet is an exposure of sensitive information to an unauthorized actor issue in FortiFone Web Portal page.
An unauthenticated attacker can trigger the flaw to obtain the device configuration via crafted HTTP or HTTPS requests.
“An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiFone Web Portal page may allow an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.” reads the advisory.
FortiFone versions 3.0.24 and 7.0.2 addressed the issue. The researcher Théo Leleu from Fortinet Product Security team reported the flaw.
It is unclear if one of the flaws addressed by Fortinet is actively exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, FortiFone)