Fortinet Issues Emergency Patch for Actively Exploited Critical FortiSIEM Bug

Fortinet has disclosed CVE-2025-25256, a critical OS command injection in FortiSIEM (CVSS 9.8) that enables unauthenticated remote code execution and is actively exploited; affected versions span FortiSIEM 6.1–7.3.1 (7.4 not affected). Fortinet urges immediate patching or restricting phMonitor (TCP 7900) access as a mitigation, while reports of widespread brute-force attacks against Fortinet SSL VPNs and a shift toward FortiManager increase urgency.