Fortinet fixed two critical flaws in FortiFone and FortiSIEM

Fortinet released patches for six vulnerabilities, including two critical unauthenticated flaws: CVE-2025-64155 (FortiSIEM — OS command injection enabling unauthenticated remote code execution via crafted TCP requests) and CVE-2025-47855 (FortiFone — unauthenticated exposure of device configuration via crafted HTTP/HTTPS requests). The advisory lists affected FortiSIEM and FortiFone versions and recommended upgrade paths, notes mitigation suggestions (e.g., limit access to phMonitor port 7900), identifies the reporting researchers, and states there is no clear evidence of active exploitation.