CVE-2025-64155: Exploit Code Released for Critical Fortinet FortiSIEM Command Injection Vulnerability

CVE-2025-64155 is a critical command injection vulnerability affecting Fortinet FortiSIEM devices with a CVSS score of 9.4. The vulnerability allows remote, unauthenticated attackers to execute arbitrary code through specially crafted requests. Public exploit code has been released by Horizon3.ai researchers, significantly increasing the risk of exploitation. Fortinet has released patches for affected versions 7.1.9+, 7.2.7+, 7.3.5+, and 7.4.1+, while older versions require migration to fixed releases. The vulnerability affects multiple FortiSIEM versions from 6.7.0 through 7.4.0, with FortiSIEM 7.5 and Cloud versions unaffected. Given Fortinet's history of being targeted by attackers (23 CVEs on CISA KEV list), this vulnerability is expected to be actively exploited soon.