CVE-2026-106176
LowCVSS 3.8Summary
A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Risk Assessment
The risk includes the possibility of unauthorized code execution, which could lead to full system compromise and data integrity violation.
Recommendation
Update FortiSIEM to a patched version and restrict access to HTTP interfaces to trusted networks only.
Other vulnerabilities in FortiSIEM
See all- CVE-2025-25256Critical
An OS Command Injection vulnerability in Fortinet FortiSIEM allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Affects multiple versions from 4.7 to 7.3.1.
- CVE-2026-84389Low
A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.
- CVE-2026-70467Low
A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.
- CVE-2026-59838Medium
An XSS vulnerability in Fortinet FortiSIEM allows an attacker to inject malicious JavaScript code into a web page. The issue affects multiple FortiSIEM versions from 6.4 to 7.4.0.
- CVE-2025-58324Medium
FortiSIEM versions 7.2.0 through 7.2.2, 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3, and 6.2 (all versions) contain a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An authenticated attacker can perform a stored XSS attack via crafted HTTP requests.
Original NVD description (English source)
A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS