CVE-2025-25256
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
An OS Command Injection vulnerability in Fortinet FortiSIEM allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Affects multiple versions from 4.7 to 7.3.1.
Risk Assessment
An attacker could take control of the FortiSIEM system, potentially compromising the confidentiality, integrity, and availability of data and the entire monitored infrastructure.
Recommendation
Immediately upgrade FortiSIEM to the latest patched version. Also restrict CLI access to trusted networks only.
Other vulnerabilities in FortiSIEM
See all- CVE-2026-84389Low
A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.
- CVE-2026-70467Low
A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.
- CVE-2026-59838Medium
An XSS vulnerability in Fortinet FortiSIEM allows an attacker to inject malicious JavaScript code into a web page. The issue affects multiple FortiSIEM versions from 6.4 to 7.4.0.
Original NVD description (English source)
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS