EUVD-2026-44668
GHSA-qgv9-w22c-fhgv
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H confirmed by requirement for existing admin session; S:C reflects script executing in victim browser outside app context; C/I/A:L appropriate for session-level XSS impact.
Primary rating from Vendor (fortinet).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Stored or reflected cross-site scripting in Fortinet FortiSIEM's web interface enables a high-privileged authenticated attacker to inject malicious script tags that execute in the browsers of other users who view the affected page. The vulnerability spans a wide version range from FortiSIEM 6.4 through 7.4.0, affecting all deployments of this enterprise SIEM platform. No active exploitation has been confirmed by CISA KEV, and no public exploit code is identified at time of analysis; the PR:H requirement meaningfully constrains real-world attacker opportunity despite the scope change to the victim's browser context.
Technical ContextAI
CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) describes a failure to sanitize or encode HTML special characters - particularly angle brackets around script-related tags - before rendering user-controlled content in a web page. Fortinet FortiSIEM (CPE: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*) is an enterprise-grade Security Information and Event Management platform with a web-based management interface. The root cause is that some input field or data-display endpoint in the FortiSIEM web UI does not properly encode attacker-supplied content before reflecting or persisting it in rendered HTML, allowing raw script tags to be interpreted by victim browsers. The CVSS scope-changed flag (S:C) confirms that the injected code executes outside the FortiSIEM application's own security context - specifically in the victim user's browser session - which is the canonical impact model for XSS. Notably, the CVE description contains an unfilled placeholder ('<insert attack vector here>') for the specific injection point, indicating the exact vulnerable parameter or endpoint has not been publicly disclosed.
RemediationAI
Consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-149 for the authoritative patch version; no specific fixed release version was present in the available input data, so an exact upgrade target cannot be cited here. Until a patch is applied, restrict access to the FortiSIEM web management interface to trusted administrator networks using firewall or ACL rules to limit who can reach the UI - this raises the bar for an attacker to both hold credentials and reach the interface. Enforce multi-factor authentication on all FortiSIEM administrator accounts to reduce the risk of credential-based attacker access that would be required to inject content. Review and minimize the number of accounts with high-privilege roles in FortiSIEM to reduce the attack surface. Enabling a Content Security Policy (CSP) header at the reverse proxy or load balancer layer in front of FortiSIEM, if architecturally feasible, can limit the impact of XSS by restricting script execution sources, though this may interfere with FortiSIEM's own UI functionality and should be tested carefully.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 a
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versi
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versi
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to pe
A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute p
An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may
A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today