CyberCVE

CVE-2026-59838

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 a

Severity
Medium 5.3
CVSS 3.1
Exploited
Not listed
EPSS
0.002
15.7th percentile
Discovered by
Third party
Vendor advisory field
Published
Jul 15, 2026
Assigned by fortinet

Description

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Weakness: CWE-80

Affected products

Vendor Product Category Matched by
Fortinet FortiSIEM SIEM & Log Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiSIEM

Credit

Fortinet is pleased to thank Anis MESSAOUDI from CPA Bank for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiSIEM version 7.5.0 or above Upgrade to FortiSIEM version 7.4.1 or above Upgrade to FortiSIEM version 7.3.5 or above Upgrade to FortiSIEM version 7.2.7 or above

References

Something wrong here?