CVE-2026-25972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25972", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-02-09T17:14:29.451Z", "datePublished": "2026-03-10T16:44:19.432Z", "dateUpdated": "2026-03-12T14:28:02.557Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSIEM", "cpes": ["cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "7.4.0", "status": "affected"}, {"versionType": "semver", "version": "7.3.0", "lessThanOrEqual": "7.3.4", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated attacker to provide arbitrary data enabling a social engineering attack via spoofed URL parameters."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-03-10T16:44:19.432Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSIEM version 7.5.0 or above\nUpgrade to FortiSIEM version 7.4.1 or above\nUpgrade to FortiSIEM version 7.3.5 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-077", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-077"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:27:55.325451Z", "id": "CVE-2026-25972", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:28:02.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25972", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T14:27:55.325451Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:27:58.719Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSIEM", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSIEM version 7.5.0 or above\nUpgrade to FortiSIEM version 7.4.1 or above\nUpgrade to FortiSIEM version 7.3.5 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-077", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-077"}], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated attacker to provide arbitrary data enabling a social engineering attack via spoofed URL parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-03-10T16:44:19.432Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25972", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:28:02.557Z", "dateReserved": "2026-02-09T17:14:29.451Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-03-10T16:44:19.432Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisiem:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiSIEM", "vendor": "Fortinet", "versions": [{"status": "affected", "version": "7.4.0"}, {"lessThanOrEqual": "7.3.4", "status": "affected", "version": "7.3.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "matchCriteriaId": "C41BBF42-F97A-4358-ADB6-9762BD8F3CAE", "versionEndExcluding": "7.3.5", "versionStartIncluding": "7.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "500DAB25-48C9-48C7-B7CD-92C06989F039", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated attacker to provide arbitrary data enabling a social engineering attack via spoofed URL parameters."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('cross-site scripting') en Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 hasta 7.3.4 puede permitir a un atacante remoto no autenticado proporcionar datos arbitrarios, lo que permite un ataque de ingenier\u00eda social a trav\u00e9s de par\u00e1metros de URL falsificados."}], "id": "CVE-2026-25972", "lastModified": "2026-06-17T10:25:32.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25972", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:27:55.325451Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:38.323", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-077"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0,7.3.4]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiSIEM", "source": "cna", "vendor": "Fortinet"}, "product": "fortisiem", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-17T11:42:16.763330+00:00", "value": {"mitigation_remediation": ["Upgrade FortiSIEM to version\u00a07.5.0 or later", "Upgrade FortiSIEM to version\u00a07.4.1 or later", "Upgrade FortiSIEM to version\u00a07.3.5 or later"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting enabling social engineering via forged URL parameters"}, "threat_synthesis": {"affected_systems": "The flaw affects Fortinet FortiSIEM versions 7.4.0 and 7.3.0 through 7.3.4. These product releases expose the vulnerable web interface to external traffic, making them susceptible to exploitation.", "description_and_impact": "The vulnerability is an improper neutralization of input during web page generation that permits an attacker to inject arbitrary script content into a FortiSIEM web page. This cross\u2011site scripting flaw can be triggered by manipulating URL parameters and is accessed remotely, so an unauthenticated attacker can embed malicious code that runs in the context of any user who visits the forged link. As a result, attackers may compromise user confidentiality, alter data or hijack sessions, and launch phishing or other social engineering campaigns without needing initial access.", "risk_and_exploitability": "With a CVSS score of 4.1 and an EPSS probability of less than 1\u00a0percent, the technical severity is moderate but the exploitability is low due to the requirement of reachability to the web UI and lack of authentication. The vulnerability is not listed in the KEV catalog, suggesting no widespread active exploitation yet. Nonetheless, because the flaw enables classic cross\u2011site scripting, attackers can leverage social engineering to deliver malicious scripts to users who click forged links."}}}}, "created": "2026-03-11T11:49:16.619541+00:00", "title": "Unrestricted XSS in FortiSIEM Web UI Enables Remote Social Engineering", "updated": "2026-04-17T11:45:06.246309+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortisiem"]}