Multiple Vulnerabilities in Fortinet Products Could Allow for Remote Code Execution

Multiple vulnerabilities were disclosed in Fortinet products, the most severe being an unauthenticated OS command injection in FortiSIEM (CVE-2025-25256) that can permit remote code execution. The advisory also lists other high- and medium-severity issues—path traversal, privilege escalation, double free, integer overflow, and auth bypass—affecting FortiManager, FortiOS, FortiProxy, and FortiPAM, and maps these flaws to Initial Access and Exploitation of Public-Facing Application techniques.