CVE-2025-25256

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

Affected

Fortinet · FortiSIEM

CVSS v3.1 FORTINET

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

65.30% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-78

Published

2025-08-12

Updated

2026-08-18

Proof-of-concept exploits (1)

• watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-2525619★ · 2025-08-15

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-25256.yaml

Security advisories

• https://fortiguard.fortinet.com/psirt/FG-IR-25-152
• https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug

References

• CVE Record
• NVD entry