Fortisiem (Fortinet) - vulnerabilities (CVEs)

35 CVEs, 2 in the last 30 days, 111 known versions, newest CVE from 2026-10-13. Vendor: Fortinet.

CVEs of Fortisiem

CVE-2026-106173 - CVSS 9.8 (critical), 2026-10-13: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute…
CVE-2026-106176 - CVSS 3.8 (low), 2026-10-13: A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP…
CVE-2026-84389 - CVSS 3.1 (low), 2026-09-08: A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow…
CVE-2026-70467 - CVSS 3.8 (low), 2026-08-12: A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2…
CVE-2026-59838 - CVSS 5.9 (medium), 2026-07-15: A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4,…
CVE-2026-59841 - CVSS 7.5 (high), 2026-07-14: A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker…
CVE-2026-25972 - CVSS 6.1 (medium), 2026-03-10: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through…
CVE-2025-64155 - CVSS 9.8 (critical), 2026-01-13: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0…
CVE-2025-58324 - CVSS 6.4 (medium), 2025-10-14: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions,…
CVE-2025-25256 - CVSS 9.8 (critical), 2025-08-12: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0…
CVE-2023-40714 - CVSS 9.9 (critical), 2025-04-02: A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege…
CVE-2019-17659 - CVSS 8.1 (high), 2025-03-17: A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the…
CVE-2024-55592 - CVSS 3.8 (low), 2025-03-11: An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5…
CVE-2023-40723 - CVSS 8.1 (high), 2025-03-11: An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and 6.5.0 through…
CVE-2024-27780 - CVSS 5.4 (medium), 2025-02-11: Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions, 7.0 all…
CVE-2024-52969 - CVSS 6.5 (medium), 2025-01-14: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, version…
CVE-2024-46667 - CVSS 7.5 (high), 2025-01-14: A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0…
CVE-2024-23109 - CVSS 10 (critical), 2024-02-05: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute…
CVE-2024-23108 - CVSS 10 (critical), 2024-02-05: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute…
CVE-2023-45585 - CVSS 3.3 (low), 2023-11-14: An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below,…
CVE-2023-41676 - CVSS 6.5 (medium), 2023-11-14: An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to…
CVE-2023-36553 - CVSS 9.8 (critical), 2023-11-14: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and…
CVE-2023-34992 - CVSS 10 (critical), 2023-10-10: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized…
CVE-2023-36551 - CVSS 5.3 (medium), 2023-09-13: A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a…
CVE-2023-26204 - CVSS 9.8 (critical), 2023-06-13: A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all…
CVE-2022-43949 - CVSS 7.5 (high), 2023-06-13: A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute…
CVE-2022-42478 - CVSS 8.8 (high), 2023-06-13: An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several…
CVE-2022-26119 - CVSS 7.8 (high), 2022-11-02: A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish…
CVE-2021-41023 - CVSS 5.5 (medium), 2021-11-02: A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due…
CVE-2021-41022 - CVSS 7.8 (high), 2021-11-02: A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via…
CVE-2019-17653 - CVSS 8.8 (high), 2020-03-12: A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform…
CVE-2019-17651 - CVSS 5.4 (medium), 2020-01-28: An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and…
CVE-2019-16153 - CVSS 9.8 (critical), 2020-01-23: A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via…
CVE-2019-6700 - CVSS 6.5 (medium), 2020-01-07: An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to…
CVE-2018-13378 - CVSS 7.2 (high), 2019-04-17: An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.