Fortinet on Tuesday announced patches for six vulnerabilities across its products, including two critical-severity bugs in FortiFone and FortiSIEM.
The most severe of these flaws is CVE-2025-64155 (CVSS score of 9.4), an OS command injection issue in FortiSIEM that could be exploited by unauthenticated attackers for code and command execution.
Exploitable via crafted TCP requests, the security defect was resolved in FortiSIEM versions 7.1.9, 7.2.7, 7.3.5, and 7.4.1.
According to Fortinet, only the Super and Worker nodes are affected, but not Collector nodes. The risk associated with the weakness can be mitigated by limiting access to the phMonitor port (7900).
The critical-severity FortiFone bug, tracked as CVE-2025-47855 (CVSS score of 9.3), impacts the appliance’s web portal and could be exploited without authentication to leak device configuration via crafted HTTP or HTTPS requests.
The vulnerability was resolved with the release of FortiFone versions 3.0.24 and 7.0.2.
On Tuesday, Fortinet also released fixes for CVE-2025-25249 (CVSS score of 7.4), a high-severity flaw in the cw_acd daemon component of FortiOS and FortiSwitchManager.
Described as a heap-based buffer overflow issue, the defect could lead to remote, unauthenticated code or command execution and can be exploited via crafted requests.
Patches for the bug were included in FortiOS versions 7.0.18, 7.2.12, 7.4.9, and 7.6.4, FortiSASE version 25.2.c, and FortiSwitchManager versions 7.0.6 and 7.2.7. Fortinet will also include the fixes in the upcoming FortiOS version 6.4.17.
As a workaround, Fortinet recommends removing ‘fabric’ access for each appliance interface, blocking access to the capwap daemon, or blocking CAPWAP-CONTROL access to port 5246-5249 for all interfaces with the ‘fabric’ service.
Fortinet on Tuesday also released patches for two medium-severity vulnerabilities in FortiClientEMS and FortiVoice, and for a low-severity bug in FortiSandbox.
The company makes no mention of any of these security defects being exploited in the wild, but users are advised to update their appliances as soon as possible. Additional information can be found on Fortinet’s PSIRT advisories page.
Related: Adobe Patches Critical Apache Tika Bug in ColdFusion
Related: Fortinet Warns of New Attacks Exploiting Old Vulnerability
Related: In-the-Wild Exploitation of Fresh Fortinet Flaws Begins
Related: Fortinet Patches Critical Authentication Bypass Vulnerabilities
