EUVD-2026-43713
GHSA-4fpq-5jrj-phcg
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network channel abuse (AV:A) with state/positioning dependencies (AC:H), no auth or interaction (PR:N/UI:N), and the elevated agent context yields full host CIA impact.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
7DescriptionCVE.org
A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here>
Articles & Coverage 1
AnalysisAI
Privilege escalation in Fortinet FortiSIEM Windows Agent 7.4.0 through 7.4.1 stems from an improper restriction of the agent's communication channel (CWE-923), letting an adjacent-network attacker interact with an endpoint that should be limited to trusted parties and thereby gain elevated privileges with full confidentiality, integrity, and availability impact. The flaw was disclosed by Fortinet PSIRT (FG-IR-26-155) and carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is gated by high attack complexity, which materially reduces real-world likelihood despite the unauthenticated vector.
Technical ContextAI
FortiSIEM is Fortinet's security information and event management platform, and the Windows Agent is the endpoint collector that runs on monitored Windows hosts to forward logs and telemetry back to the FortiSIEM supervisor/collector. The root cause is CWE-923, improper restriction of communication to intended endpoints - the agent (or its update/registration channel) does not sufficiently verify or constrain which peers it will communicate with, so an unintended party can insert itself into or abuse that channel. Because the agent typically runs with elevated (SYSTEM/service) privileges to collect host data, abusing this trust relationship can translate into escalation of privilege on the affected host. The affected component is identified by CPE cpe:2.3:a:fortinet:fortisiemwindowsagent:*:*:*:*:*:*:*:*.
RemediationAI
Patch available per vendor advisory FG-IR-26-155 (https://fortiguard.fortinet.com/psirt/FG-IR-26-155) - upgrade FortiSIEM Windows Agent beyond the affected 7.4.0-7.4.1 range to the fixed release specified by Fortinet; an exact fixed version is not included in the provided data and should be taken directly from the advisory. Until patching is complete, reduce exposure to the adjacent-network vector by segmenting monitored Windows hosts onto trusted VLANs, restricting layer-2/adjacent access to the agent's listening/communication ports via host firewall rules, and ensuring the agent only communicates with the known FortiSIEM collector/supervisor addresses (trade-off: overly tight host firewalling can break legitimate log forwarding, so validate collector connectivity after applying rules). Because the high attack complexity already limits practical exploitation, these compensating controls are reasonable stopgaps but are not a substitute for the vendor fix.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today