FortiSIEM EUVD-2026-98967

Requires an already-authenticated, high-privilege FortiSIEM account (PR:H) on an affected FortiSIEM 7.5.0 deployment; the attacker then sends specially crafted HTTP requests to a function missing an authorization check. The primary limiting factor is this high privilege prerequisite - exploitation is not available to unauthenticated or low-privilege users, confining realistic abuse to malicious insiders or attackers who have already compromised a privileged account. Only version 7.5.0 is named as affected per the Fortinet advisory.

This is a genuinely low-priority issue despite being a network-exploitable code/command execution flaw. The CVSS 3.1 base score is only 3.8, driven by the combination of PR:H (high privileges required - the attacker must already be an authenticated, privileged FortiSIEM user) and limited impact (C:N/I:L/A:L - no confidentiality loss and only partial integrity/availability impact). Attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), so once a privileged account is held, triggering is straightforward, but the PR:H prerequisite sharply narrows the realistic attacker population to insiders or those who have already compromised a high-privilege account. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The 'Authentication Bypass' tag is in tension with the underlying data: CWE-862 is a missing-authorization weakness and PR:H indicates the attacker is already authenticated, so this is a post-authentication authorization gap rather than a true authentication bypass - treat the tag as loose labeling. Net: a real but low-severity defect to patch on a normal cycle, not an emergency.

An authenticated FortiSIEM user holding high privileges sends specially crafted HTTP requests to a FortiSIEM 7.5.0 instance, reaching functionality that fails to enforce proper authorization and executing unauthorized code or commands within the limited scope the flaw permits. No public exploit code was identified in the provided data, and the required high privilege level means the most realistic actor is a malicious insider or an attacker who has already captured a privileged session.