Cross-Site Scripting Vulnerability in Fortinet FortiSIEM
CVE-2026-25972

4.1MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortisiem
Vendor
CVE Published:
10 March 2026

What is CVE-2026-25972?

An improper neutralization of input during web page generation vulnerability exists in Fortinet's FortiSIEM versions 7.4.0 and 7.3.0 through 7.3.4. This flaw allows remote unauthenticated attackers to inject arbitrary data through URL parameters. Exploiting this vulnerability can facilitate social engineering attacks, potentially leading to the compromise of user interactions and sensitive information.

Affected Version(s)

FortiSIEM 7.4.0

FortiSIEM 7.3.0 <= 7.3.4

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-077

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.