Report feedback

An unauthenticated remote attacker can execute commands in the operating system of the affected machine with root privileges by sending specially crafted TCP requests. The vulnerability affects only Super and Worker nodes. As a temporary fix, access to the phMonitor port can be restricted to trusted IP addresses only [1]. Further technical details about the vulnerability can be found at [7] and a PoC script can be found at [8]. According to the Defused organization, the vulnerability is being actively exploited in its honeypots [9].

The vulnerability is present in product:

• FortiSIEM; >=7.4.0; <7.4.1; >=7.3.0, <7.3.5; >=7.2.0, <7.2.7; >=7.1.0, <7.1.9; >=7.0.0, <=7.0.4; >=6.7.0, <=6.7.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

More information:

• CVE-2025-64155 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.

An unauthenticated remote attacker can obtain the configuration of the affected device by sending specially crafted HTTP(S) requests [2].

The vulnerability is present in product:

• FortiFone; >=7.0.0, <7.2.0; >=3.0.13; <3.0.24;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C

More information:

• CVE-2025-47855 at cve.org, NVD
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.

An unauthenticated remote attacker can execute arbitrary code or commands by sending specially crafted requests. Using security controls such as ASLR and PIE can reduce the likelihood of the vulnerability being exploited [3].

The vulnerability is present in products:

• FortiOS; >=7.6.0; <7.6.4; >=7.4.0, <7.4.9; >=7.2.0, <7.2.12; >=7.0.0, <7.0.18; >=6.4.0, <6.4.17;
• FortiSwitchManager; >=7.2, <7.2.7; >=7.0.0, <7.0.6;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C

More information:

• CVE-2025-25249 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.

An authenticated remote attacker with administrator read-only privileges can carry out an SQL injection attack by sending specially crafted HTTP(S) requests [4].

The vulnerability is present in product:

• FortiClientEMS; >=7.4.3, <7.4.5; >=7.4.0, <7.4.1; >=7.2.0, <7.2.12;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

More information:

• CVE-2025-59922 at cve.org, NVD
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.

An authenticated remote attacker can delete files from the operating system of the affected device by sending specially crafted HTTP(S) requests [5].

The vulnerability is present in product:

• FortiVoice; >=7.2.0, <7.2.3; >=7.0.0, <7.0.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C

More information:

• CVE-2025-58693 at cve.org, NVD
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.

An authenticated remote attacker can carry out an SSRF attack, limited to internal endpoints that use only the HTTP protocol [6].

The vulnerability is present in product:

• FortiSandbox; >=4.0.0, <5.0.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C

More information:

• CVE-2025-67685 at cve.org, NVD
• CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org

The vulnerability was publicly disclosed 13. 1. 2026.