EUVD-2026-98968
GHSA-5cx2-chqq-627m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FortiSIEM network service
-
DeliverySend specially crafted packets
-
ExploitTrigger path traversal (CWE-22)
-
ExecutionAccess/write files outside restricted directory
-
PersistExecute unauthorized code or commands
-
ImpactFull compromise of SIEM host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation of FortiSIEM, with the attacker sending specially crafted packets to the affected service. The description names no non-default feature or configuration setting that must be enabled, so default deployments exposing the vulnerable network service appear affected. The main limiting factors are: the attacker must have network access to the listening service/port (an appliance not exposed to untrusted networks reduces exposure), and the only version identified in the CVSS/CPE data is FortiSIEM 7.5.0 - other versions' status is not confirmed in the input and should be checked against advisory FG-IR-26-180. |
| Impact | All signals point to a genuine high-priority issue rather than a CVSS-inflated low-risk one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with the CWE-22 path traversal escalating to code/command execution. The 9.8 score is well justified by the vector. However, several corroborating signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no public POC indicator, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC should NOT be read as low risk - it reflects data gaps, not confirmed safety, and a vendor-reported critical pre-auth RCE on a security appliance is a patch-now candidate. One item to verify: execution is attributed to 'specially crafted packets,' which is consistent with the network vector, but the exact affected service/port and whether only FortiSIEM 7.5.0 (the single version in the CVSS/CPE data) is impacted should be confirmed against Fortinet advisory FG-IR-26-180. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to a FortiSIEM 7.5.0 instance sends specially crafted packets that exploit the path traversal flaw to access or write files outside the intended directory, leading to execution of unauthorized code or commands. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or complex preconditions are required. No public exploit code is identified at time of analysis, but the pre-authentication, low-complexity profile makes reliable exploitation plausible once details are derived from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Path traversal in Fortinet FortiSIEM 7.5.0 can let a remote unauthenticated attacker execute unauthorized code or commands by sending specially crafted packets to the affected service. The CVSS vector shows network exploitation with low complexity, no privileges, and no user interaction, producing high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence; consult Fortinet advisory FG-IR-26-180 for the authoritative affected-version and remediation details.
RemediationAI
The provided input does not identify an exact fixed version or confirm patch availability, so the primary action is to consult Fortinet advisory FG-IR-26-180 (https://fortiguard.fortinet.com/psirt/FG-IR-26-180) for the authoritative fix and upgrade path for FortiSIEM 7.5.0; if a fixed release is listed, upgrade to that version. If no patch is available, reduce exposure by restricting network access to the FortiSIEM service to trusted management networks, blocking the affected listener at perimeter firewalls, and segmenting the appliance from untrusted networks - with the trade-off of reduced remote access for administrators and integrations. Disable or firewall any unnecessary FortiSIEM listener ports if they are not required, understanding that this may break data collection or management workflows. Monitor logs for path traversal patterns targeting FortiSIEM endpoints, but treat detection as a compensating control rather than a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), often called path traversal, in FortiSIEM, Fortinet's security information and event management appliance. The CPE cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* identifies Fortinet FortiSIEM as the affected product family, while the description narrows the reported vulnerable release to 7.5.0. Root cause is insufficient canonicalization or validation of attacker-supplied path components, allowing ../ sequences, absolute paths, or similar traversal payloads to escape an intended directory boundary. Because the vector is AV:N/AC:L/PR:N/UI:N and the description references specially crafted packets, the vulnerable path is reachable over the network without authentication or user interaction; no non-default feature is named as a prerequisite in the advisory data, so default deployments exposing the service should be treated as at risk. The resulting unauthorized code or command execution is consistent with the high CIA impact in the CVSS assessment.
Know when Fortisiem gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Specially crafted packets allow pre-auth path traversal to code execution, so AV:N/AC:L/PR:N/UI:N; full host compromise gives C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
Articles & Coverage 2
Executive ViewAI
FortiSIEM 7.5.0 contains a critical unauthenticated remote code execution vulnerability that can be triggered over the network, putting the security operations platform and its sensitive telemetry at severe risk. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the organization must rely on containment while awaiting a fix. Leadership should prioritize immediate exposure reduction because compromise could disrupt monitoring and enable further attacks across the environment.
No vendor-released patch identified at time of analysis; restrict network access to FortiSIEM 7.5.0 management/API/collector services, segment the platform from untrusted networks, apply IPS/WAF virtual patching for path traversal attempts, monitor logs for exploitation, and maintain offline backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 a
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versi
A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versi
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to pe
A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute p
An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may
A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated
Exploit-DB