CVE-2025-58324: 
FortiSIEM vulnerability analysis and mitigation

CVE-2025-58324 is a stored cross-site scripting (XSS) vulnerability affecting FortiSIEM's parser tester component. The vulnerability was discovered by Ersin SARISOY from Beyaz Net and was publicly disclosed on October 14, 2025. This security flaw affects multiple versions of FortiSIEM, including versions 6.2 through 7.2.2 (Fortinet PSIRT).

The vulnerability is classified as an improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM's GUI component. It has been assigned a CVSS v3.1 score of 6.1 (Medium severity), with attack vector parameters indicating Network-based attack vector, High attack complexity, High privileges required, and User interaction required (Fortinet PSIRT).

The vulnerability allows an authenticated attacker to perform a stored cross-site scripting (XSS) attack via crafted HTTP requests, potentially leading to unauthorized code execution or commands on the affected systems (Fortinet PSIRT).

Fortinet has released patches to address this vulnerability. Users of FortiSIEM 7.2.0 through 7.2.2 should upgrade to version 7.2.3 or above. Users of FortiSIEM versions 6.2 through 7.1 are advised to migrate to a fixed release. Versions 7.3 and 7.4 are not affected by this vulnerability (Fortinet PSIRT).