{"id":"CVE-2025-64155","published":"2026-01-13T16:32:28Z","modified":"2026-02-26T15:04:42Z","title":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSIEM","versions":["7.4.0",">= 7.3.0, <= 7.3.4","7.2.6","7.1.8","7.0.4","6.7.10"]}],"description":{"text":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via  crafted TCP requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw in Fortinet FortiSIEM, affecting the 7.4.0, 7.3.0 through 7.3.4, 7.1.0 through 7.1.8, 7.0.0 through 7.0.4, and 6.7.0 through 6.7.10 releases, arises from improper neutralization of special elements in commands the product executes. An attacker who sends crafted TCP requests to the affected service can execute unauthorized code or commands.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:11Z"},"cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.43599,"percentile":0.98737,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-15","exploitedFirstSeen":"2026-01-15","ransomware":false,"evidence":[{"url":"https://x.com/DefusedCyber/status/2011825776744595960","date":"2026-01-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"Fortinet FortiGate Firewalls Targeted in Large-Scale SSO Account Compromise Campaign","url":"https://otx.alienvault.com/pulse/69730816562f2c64605ea3c3","created":"2026-01-23"},{"name":"Malicious Configuration Changes Observed On Fortinet FortiGate Devices via SSO Accounts","url":"https://otx.alienvault.com/pulse/6972f537ede3061d2db064b9","created":"2026-01-23"},{"name":"Malicious Configuration Changes Observed On Fortinet FortiGate Devices via SSO Accounts","url":"https://otx.alienvault.com/pulse/697171c9e4aec4d7963e9440","created":"2026-01-22"},{"name":"Fortinet Addresses High-Risk FortiSIEM Vulnerability Enabling Full System Takeover","url":"https://otx.alienvault.com/pulse/696847739546aac8369d1190","created":"2026-01-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-772","tags":[]},{"url":"https://github.com/horizon3ai/CVE-2025-64155","tags":["exploit"]},{"url":"https://github.com/purehate/CVE-2025-64155-hunter","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-2076","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2076","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2026-01-13","earliestUrl":"https://github.com/horizon3ai/CVE-2025-64155","repos":[{"name":"horizon3ai/CVE-2025-64155","url":"https://github.com/horizon3ai/CVE-2025-64155","stars":33,"created":"2026-01-13"},{"name":"cyberdudebivash/CYBERDUDEBIVASH-FortiSIEM-CVE-2025-64155-Scanner","url":"https://github.com/cyberdudebivash/CYBERDUDEBIVASH-FortiSIEM-CVE-2025-64155-Scanner","stars":1,"created":"2026-01-15"},{"name":"purehate/CVE-2025-64155-hunter","url":"https://github.com/purehate/CVE-2025-64155-hunter","stars":0,"created":"2026-01-14"},{"name":"Mefhika120/Ashwesker-CVE-2025-64155","url":"https://github.com/Mefhika120/Ashwesker-CVE-2025-64155","stars":0,"created":"2026-01-25"}]},"first":{"date":"2026-01-13","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2025-64155"},"provenance":"source"},"exploitRefs":["https://github.com/horizon3ai/CVE-2025-64155","https://github.com/purehate/CVE-2025-64155-hunter"],"flow":[],"timeline":[{"date":"2026-01-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-64155","provenance":"source"},{"date":"2026-01-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2025-64155","provenance":"source"},{"date":"2026-01-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/DefusedCyber/status/2011825776744595960","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":72.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 288 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.75,"detail":"percentile 0.9874"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}