Fortinet PSIRT Monthly Advisories — January 2026

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• High 7.4
  CVE-2025-25249 Exploited A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 th…
  EPSS 3.7%

Critical 2

• Critical 9.4
  CVE-2025-64155 Public exploit An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 throug…
  EPSS 44%
• Critical 9.3
  CVE-2025-47855 An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.2…

All vulnerabilities 6