FortiSIEM Windows Agent EUVD-2026-43713

Exploitation requires network adjacency (AV:A) - the attacker must be on the same local/broadcast segment as the FortiSIEM Windows Agent, not arbitrarily remote across the internet - targeting FortiSIEM Windows Agent 7.4.0 or 7.4.1 specifically. No authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack complexity (AC:H) means success depends on conditions outside the attacker's direct control, such as winning a race, precise network positioning, or a specific agent communication state tied to the CWE-923 unrestricted channel. Limiting factors: the adjacency requirement excludes purely remote attackers, the AC:H gating reduces reliability, and only the 7.4.0-7.4.1 Windows Agent builds are in scope.

The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes an unauthenticated attack with no user interaction but constrained to the adjacent network and requiring high attack complexity, which is why the score lands at 7.5 (High) rather than Critical despite full CIA impact. No EPSS score, POC, or KEV entry is present in the provided data, so there is no evidence of active or automatable exploitation - the combination of AC:H and AV:A points to a targeted, position-dependent attack rather than mass exploitation. Notably, the description characterizes this as 'escalation of privilege' (typically a local outcome) while the CVSS vector uses AV:A (adjacent network); this is a mild tension worth verifying with the vendor, likely reconciled by an attacker on the same layer-2 segment abusing the agent's communication channel to gain privileges on the host. Overall this is a legitimate but not top-tier emergency priority: patch on a normal cycle, prioritizing hosts on shared/untrusted network segments.

An attacker who has gained a foothold on the same adjacent network segment as a monitored Windows host abuses the agent's improperly restricted communication channel to impersonate or inject into a trusted endpoint, then leverages the agent's elevated service privileges to escalate on the host. Success depends on satisfying the high-complexity preconditions (e.g., specific timing, network positioning, or state), and no public proof-of-concept is currently known.