Critical Fortinet FortiSIEM Vulnerability Exploited in Attacks: Implications for North East India and Beyond

Understanding the Vulnerability

A critical vulnerability in Fortinet's FortiSIEM has been exploited in attacks, as reported by security researcher Zach Hanley at Horizon3.ai. The flaw, identified as CVE-2025-64155, combines two issues that allow arbitrary writes with admin permissions and privilege escalation to root access.

The vulnerability, an OS Command Injection, allows unauthenticated attackers to execute unauthorized code or commands via crafted TCP requests. Fortinet released security updates to patch the flaw on Tuesday.

Impact and Patching

The vulnerability affects FortiSIEM versions 6.7 to 7.5 and can be patched by upgrading to FortiSIEM 7.4.1 or later, 7.3.5 or later, 7.2.7 or later, or 7.1.9 or later. Customers using FortiSIEM 7.0.0 through 7.0.4 and FortiSIEM 6.7.0 through 6.7.10 are advised to migrate to a fixed release.

For admins who cannot immediately apply security updates, Fortinet has provided a temporary workaround requiring them to limit access to the phMonitor port (7900).

Wild Exploitation and Indicators of Compromise

Two days after Fortinet released the security updates, Defused, a threat intelligence firm, reported that threat actors are now actively exploiting the CVE-2025-64155 flaw in the wild. Horizon3.ai also provides indicators of compromise to help defenders identify already compromised systems.

Admins can find evidence of malicious abuse by checking the phMonitor message logs at /opt/phoenix/log/phoenix.logs for payload URLs on lines that contain PHL_ERROR entries.

Relevance to North East India and Broader Indian Context

Given the widespread nature of cyber threats and the increasing reliance on digital infrastructure, it is crucial for organizations in North East India and across India to prioritize cybersecurity. The exploitation of critical vulnerabilities, such as CVE-2025-64155, underscores the need for timely updates, robust security measures, and continuous monitoring.

Looking Forward

As cyber threats continue to evolve, it is essential for organizations to stay vigilant and proactive in their cybersecurity strategies. This includes keeping software up-to-date, implementing strong access controls, and regularly reviewing security practices.

In the wake of the active exploitation of CVE-2025-64155, it is crucial for Fortinet customers to apply the security updates and, if necessary, implement the temporary workaround provided by Fortinet.