Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed

Fortinet published security advisories for multiple critical vulnerabilities across FortiSIEM, FortiOS/FortiSwitch Manager, FortiFone, and other products—most notably CVE-2025-64155 (FortiSIEM OS command injection, CVSS 9.4) and CVE-2025-47855 (FortiFone info disclosure, CVSS 9.3). The flaws permit unauthenticated remote code execution, sensitive config disclosure, file deletion, SQL injection, and SSRF; Fortinet released fixed versions and provided mitigation guidance (restricting ports, removing fabric access, or upgrading to specified patched releases).