Fortinet Fortisiem vulnerabilities

35 CVEs affecting Fortinet Fortisiem, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106176, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-34992, published 2023-10-10. Critical severity, CVSS 9.8. EPSS: 81.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API…
CVE-2024-23108, published 2024-02-05. Critical severity, CVSS 9.8. EPSS: 80.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API…
CVE-2025-25256, published 2025-08-12. Critical severity, CVSS 9.8. EPSS: 65.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through…
CVE-2025-64155, published 2026-01-13. Critical severity, CVSS 9.8. EPSS: 42.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8,…
CVE-2024-23109, published 2024-02-05. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API…
CVE-2023-36553, published 2023-11-14. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through…
CVE-2018-13378, published 2019-04-17. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.
CVE-2019-16153, published 2020-01-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
CVE-2019-6700, published 2020-01-07. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password…
CVE-2023-40714, published 2025-04-02. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements

Latest

CVE-2026-106176, published 2026-10-13. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
CVE-2026-106173, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially…
CVE-2026-84389, published 2026-09-08. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or…
CVE-2026-70467, published 2026-08-12. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions,…
CVE-2026-59838, published 2026-07-15. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1…
CVE-2026-59841, published 2026-07-14. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert…
CVE-2026-25972, published 2026-03-10. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated…
CVE-2025-58324, published 2025-10-14. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all…