CVE-2026-59838

MEDIUM

Fortinet FortiSIEM - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Title source: rule
STIX 2.1

Description

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

References (1)

Core 1

Scores

CVSS v3 5.9
EPSS 0.0014
EPSS Percentile 4.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-80
Status published
Products (13)
fortinet/fortisiem 7.4.0
Fortinet/FortiSIEM 6.2.0 - 6.2.1
Fortinet/FortiSIEM 6.3.0 - 6.3.3
Fortinet/FortiSIEM 6.4.0 - 6.4.4
fortinet/fortisiem 6.4.0 - 7.2.7
Fortinet/FortiSIEM 6.5.0 - 6.5.3
Fortinet/FortiSIEM 6.6.0 - 6.6.5
Fortinet/FortiSIEM 6.7.0 - 6.7.10
Fortinet/FortiSIEM 7.0.0 - 7.0.4
Fortinet/FortiSIEM 7.1.0 - 7.1.9
... and 3 more
Published Jul 15, 2026
Tracked Since Jul 15, 2026