--- title: CVE-2025-64155 | daily.dev description: Fortinet patched a critical FortiSIEM vulnerability (CVE-2025-64155) allowing unauthenticated remote code execution through command injection in the phMonitor... canonical: https://daily.dev/posts/cve-2025-64155-yyw5e5o3k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2025-64155 | daily.dev og:description: Fortinet patched a critical FortiSIEM vulnerability (CVE-2025-64155) allowing unauthenticated remote code execution through command injection in the phMonitor... og:url: https://daily.dev/posts/cve-2025-64155-yyw5e5o3k og:image: https://api.daily.dev/og/posts/yYW5E5O3k.png og:image:alt: CVE-2025-64155 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2025-64155 **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 2 min read · 0 upvotes · 0 comments ## Summary Fortinet patched a critical FortiSIEM vulnerability (CVE-2025-64155) allowing unauthenticated remote code execution through command injection in the phMonitor service. The flaw enables full system takeover with privilege escalation from admin to root. While not yet exploited in the wild, a public proof-of-concept exists. Affected versions span FortiSIEM 6.7 through 7.4, with patches available. Organizations should upgrade immediately, isolate FortiSIEM from the internet, and restrict access to TCP port 7900 if patching is delayed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CVE-2026-21643: Critical SQL Injection in FortiClientEMS](https://daily.dev/posts/cve-2026-21643-critical-sql-injection-in-forticlientems-qxiu6qu9c) · Arctic Wolf · 1 upvotes · 0 comments - [Critical Fortinet FortiSandbox flaws now exploited in attacks](https://daily.dev/posts/critical-fortinet-fortisandbox-flaws-now-exploited-in-attacks-ppy51tykp) · BleepingComputer · 3 upvotes · 0 comments - [CVE-2025-25249: Remote Code Execution Vulnerability in FortiOS and FortiSwitchManager](https://daily.dev/posts/cve-2025-25249-remote-code-execution-vulnerability-in-fortios-and-fortiswitchmanager-joa3ypxd0) · Arctic Wolf · 0 upvotes · 0 comments - [Critical Fortinet sandbox bugs allow auth bypass and RCE](https://daily.dev/posts/critical-fortinet-sandbox-bugs-allow-auth-bypass-and-rce-av1wd0io9) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#devops](https://daily.dev/tags/devops), [#vulnerability](https://daily.dev/tags/vulnerability), [#fortinet](https://daily.dev/tags/fortinet) [View this post on daily.dev](https://daily.dev/posts/cve-2025-64155-yyw5e5o3k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2025-64155","url":"https://daily.dev/posts/cve-2025-64155-yyw5e5o3k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2025-64155-yyw5e5o3k"},"datePublished":"2026-01-15T17:38:47.871Z","dateModified":"2026-01-15T17:39:30.494Z","description":"Fortinet patched a critical FortiSIEM vulnerability (CVE-2025-64155) allowing unauthenticated remote code execution through command injection in the phMonitor...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd557fc70752784acd90c656770fff8b?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd557fc70752784acd90c656770fff8b?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2025-64155-yyw5e5o3k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,devops,vulnerability,fortinet","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"CVE-2025-64155"}]} ```