{“lastseen”:”2025-08-13T13:08:16″,”description”:”\\n\\nFortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild.\\n\\nThe vulnerability, tracked as **CVE-2025-25256** , carries a CVSS score of 9.8 out of a maximum of 10.0.\\n\\n\\”An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests,\\” the company said in a Tuesday advisory.\\n\\nThe following versions are impacted by the flaw -\\n\\n * FortiSIEM 6.1, 6.2, 6.3, 6.4, 6.5, 6.6 (Migrate to a fixed release)\\n * FortiSIEM 6.7.0 through 6.7.9 (Upgrade to 6.7.10 or above)\\n * FortiSIEM 7.0.0 through 7.0.3 (Upgrade to 7.0.4 or above)\\n * FortiSIEM 7.1.0 through 7.1.7 (Upgrade to 7.1.8 or above)\\n * FortiSIEM 7.2.0 through 7.2.5 (Upgrade to 7.2.6 or above)\\n * FortiSIEM 7.3.0 through 7.3.1 (Upgrade to 7.3.2 or above)\\n * FortiSIEM 7.4 (Not affected)\\n\\n\\n\\n\\n\\nFortinet acknowledged in its advisory that a \\”practical exploit code for this vulnerability was found in the wild,\\” but did not share any additional specifics about the nature of the exploit and where it was found. It also noted that the exploitation code does not appear to produce distinctive indicators of compromise (IoCs).\\n\\nAs workarounds, the network security company is recommending that organizations limit access to the phMonitor port (7900).\\n\\nThe disclosure comes a day after GreyNoise warned of a \\”significant spike\\” in brute-force traffic aimed at Fortinet SSL VPN devices, with dozens of IP addresses from the United States, Canada, Russia, and the Netherlands probing devices located across the world.\\n\\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2025-08-13T11:37:00″,”modified”:”2025-08-13T11:37:38″,”type”:”thn”,”title”:”Fortinet Warns About FortiSIEM Vulnerability (CVE-2025-25256) With In-the-Wild Exploit Code”,”source”:””,”references”:””,”id”:”THN:6424C9AEB80EB4FC9DACB5F58A480B35″,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[“CVE-2025-25256″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2025\/08\/fortinet-warns-about-fortisiem.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-13T13:08:16″,”description”:”\\n\\nFortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild.\\n\\nThe vulnerability,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[9,6,8,35,12,13,7,11,43,5],"class_list":["post-10552","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n