CVE-2026-59838
Full vulnerability record from the local CVENow database.
Description
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Severity
MEDIUM
CVSS score
4.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-15 14:18:33.057000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-59838",
"sourceIdentifier": "[email protected]",
"published": "2026-07-15T14:18:33.057",
"lastModified": "2026-10-24T21:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>"
},
{
"lang": "es",
"value": "Una vulnerabilidad de neutralización inadecuada de etiquetas HTML relacionadas con scripts en una página web (XSS básico) en Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 hasta 7.3.4, FortiSIEM 7.2.0 hasta 7.2.6, FortiSIEM 7.1 todas las versiones, FortiSIEM 7.0 todas las versiones, FortiSIEM 6.7 todas las versiones, FortiSIEM 6.6 todas las versiones, FortiSIEM 6.5 todas las versiones, FortiSIEM 6.4 todas las versiones puede permitir al atacante ejecutar código o comandos no autorizados a través de <insertar vector de ataque aquí>"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiSIEM",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisiem:6.2.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.4.0",
"status": "affected"
},
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.1.0",
"lessThanOrEqual": "7.1.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.7.0",
"lessThanOrEqual": "6.7.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.6.0",
"lessThanOrEqual": "6.6.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.5.0",
"lessThanOrEqual": "6.5.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.0",
"lessThanOrEqual": "6.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.3.0",
"lessThanOrEqual": "6.3.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.2.0",
"lessThanOrEqual": "6.2.1",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-15T14:23:06.140913Z",
"id": "CVE-2026-59838",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-80"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.0",
"versionEndExcluding": "7.2.7",
"matchCriteriaId": "2027BD6B-7592-426A-B110-6EEFEF9BFC5C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.3.0",
"versionEndExcluding": "7.3.5",
"matchCriteriaId": "C41BBF42-F97A-4358-ADB6-9762BD8F3CAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "500DAB25-48C9-48C7-B7CD-92C06989F039"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-149",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}