Fortinet discloses critical bug with working exploit code amid surge in brute-force attempts

Fortinet warned customers about a critical FortiSIEM bug that could allow an unauthenticated attacker to execute unauthorized commands, and said working exploit code for the flaw has been found in the wild. The OS-command-injection vulnerability, tracked as CVE-2025-25256, received a 9.8 CVSS rating and affects multiple versions of the security tool: 7.3.0-7.3.1, 7.2.0-7.2.5, 7.1.0-7.1.7, 7.0.0-7.0.3, and before 6.7.9. Customers need to upgrade to a fixed version and, as a workaround, the vendor suggests limiting access to the phMonitor port (7900). An unauthenticated attacker can abuse this flaw by crafting a CLI request and then executing arbitrary commands on the operating system, which can allow complete system takeover. And, according to the security advisory, miscreants don't even need to work very hard to do this, as "practical exploit code for this vulnerability was found in the wild." Fortinet did not respond to The Register's questions, including whether it was aware of any exploitation. The disclosure follows a warning from GreyNoise about a surge in brute-force traffic targeting Fortinet SSL VPNs. On Tuesday, the threat-intel biz said it observed a spike in these credential-abusing attempts against Fortinet on August 3, with more than 780 unique IPs attempting to gain unauthorized access. "Spikes like this often precede the disclosure of new vulnerabilities affecting the same vendor — most within six weeks," GreyNoise Head of Content Noah Stone wrote. "In fact, Gr...