CVE-2025-64155

Critical · 9.8

CVSS

9.8

EPSS

42.5%

Published

Jan 13, 2026

CISA due date

—

The record

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

Affected packages

Ecosystem	Package	Introduced	Fixed