CVE-2026-59838

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-149	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortisiem::::::::
	cpe:2.3:a:fortinet:fortisiem::::::::
	cpe:2.3:a:fortinet:fortisiem:7.4.0:::::::*

History

No history.

Information

Published : 2026-07-15 14:18

Updated : 2026-07-15 18:47

NVD link : CVE-2026-59838

Mitre link : CVE-2026-59838

CVE.ORG link : CVE-2026-59838

JSON object : View

Products Affected

fortinet

fortisiem

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-59838", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59838", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:23:06.140913Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:6.2.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSIEM", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.4"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.6"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.9"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.4"}, {"status": "affected", "version": "6.7.0", "versionType": "semver", "lessThanOrEqual": "6.7.10"}, {"status": "affected", "version": "6.6.0", "versionType": "semver", "lessThanOrEqual": "6.6.5"}, {"status": "affected", "version": "6.5.0", "versionType": "semver", "lessThanOrEqual": "6.5.3"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.4"}, {"status": "affected", "version": "6.3.0", "versionType": "semver", "lessThanOrEqual": "6.3.3"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-15T14:18:33.057", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-149", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>"}], "lastModified": "2026-07-15T18:47:38.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2027BD6B-7592-426A-B110-6EEFEF9BFC5C", "versionEndExcluding": "7.2.7", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C41BBF42-F97A-4358-ADB6-9762BD8F3CAE", "versionEndExcluding": "7.3.5", "versionStartIncluding": "7.3.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "500DAB25-48C9-48C7-B7CD-92C06989F039"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}