CVE-2026-70467
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the system and perform malicious actions, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to apply vendor-provided patches immediately and restrict access to FortiSIEM to trusted users only.
Other vulnerabilities in FortiSIEM
See all- CVE-2025-25256Critical
An OS Command Injection vulnerability in Fortinet FortiSIEM allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Affects multiple versions from 4.7 to 7.3.1.
- CVE-2026-84389Low
A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.
- CVE-2026-59838Medium
An XSS vulnerability in Fortinet FortiSIEM allows an attacker to inject malicious JavaScript code into a web page. The issue affects multiple FortiSIEM versions from 6.4 to 7.4.0.
Original NVD description (English source)
A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS