An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through…

A critical OS command injection vulnerability (CVE-2025-64155) affects multiple versions of Fortinet FortiSIEM, including versions 6.7.0 through 7.4.0. The vulnerability stems from improper neutralization of special elements used in OS commands. Attackers can exploit this flaw by sending crafted TCP requests to execute unauthorized code or commands on affected systems. The vulnerability impacts a wide range of FortiSIEM versions across major release branches. This represents a significant security risk for organizations using FortiSIEM for security information and event management.