EUVD-2026-57190
GHSA-6p3g-37q6-r7f3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-accessible SSRF requiring high-privilege authentication; scope unchanged; low confidentiality and integrity impact with no availability effect align with SSRF-class information disclosure.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Server-side request forgery in Fortinet FortiSIEM across an extensive version range (6.4.x through 7.5.0) permits authenticated high-privileged attackers to force the server to issue unauthorized requests to internal or external resources, enabling potential lateral movement to internal network services and limited information disclosure. The CVSS base score of 3.4 reflects the dominant mitigating factor of mandatory high-privilege authentication (PR:H), confining exploitation to insiders or post-compromise scenarios. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, though no CISA KEV listing indicates active widespread exploitation at time of analysis.
Technical ContextAI
FortiSIEM is Fortinet's enterprise Security Information and Event Management platform, aggregating telemetry from across an organization's environment and maintaining broad network connectivity to monitored systems. CWE-918 (Server-Side Request Forgery) arises when a web application fetches remote resources based on insufficiently validated user-controlled input, allowing attackers to redirect server-initiated requests to unintended destinations - including internal APIs, cloud metadata endpoints, or adjacent network services that would otherwise be firewalled from external access. Because SIEM platforms like FortiSIEM are positioned with privileged visibility into internal infrastructure, SSRF is particularly consequential in this product class: internal resources reachable by the FortiSIEM server process may include sensitive management interfaces. The affected CPE (cpe:2.3:a:fortinet:fortisiem) spans ten distinct version branches from 6.4.1 through 7.5.0, indicating a long-standing architectural issue rather than a regression in a single release. The CVE description includes a literal placeholder ('via <insert attack vector here>'), meaning the specific triggering endpoint or feature has not been disclosed in currently available data.
RemediationAI
The CVSS temporal metric RL:O confirms Fortinet has released an official fix; consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-159 for fixed versions applicable to each affected branch and upgrade guidance. Exact patched version numbers are not independently confirmed from available data and must be verified directly from the vendor advisory before deployment. Where immediate patching is not feasible, apply the following compensating controls: restrict administrative access to the FortiSIEM web interface to trusted management subnets via firewall ACLs, eliminating network reachability for untrusted high-privilege sessions; enforce multi-factor authentication on all privileged FortiSIEM accounts to raise the cost of credential-based exploitation; and review outbound request logging on FortiSIEM hosts for anomalous connections to unexpected internal destinations indicative of SSRF abuse. Network segmentation that limits what internal resources the FortiSIEM server can reach reduces SSRF blast radius. Note that ACL-based management isolation may affect legitimate remote administration workflows and should be coordinated with operations teams.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 a
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versi
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versi
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to pe
A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute p
An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may
A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today