Fortinet SIEM issue coincides with spike in brute-force traffic against company’s SSL VPNs

Fortinet disclosed a critical OS command injection vulnerability (CVE-2025-25256, CVSS 9.8) in FortiSIEM with practical exploit code reported in the wild; Fortinet advises upgrading affected versions and restricting access to port 7900. GreyNoise reported a significant spike in brute-force activity targeting Fortinet SSL VPNs (hundreds of unique IPs and dozens of malicious sources), raising concern that public exploit code could accelerate exploitation given past widespread abuse of Fortinet defects.