CVE-2026-106176: 
FortiSIEM vulnerability analysis and mitigation

CVE-2026-106176 is a missing authorization vulnerability (CWE-862) in Fortinet FortiSIEM's GUI component that may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests. It affects FortiSIEM versions 6.4.0–6.4.4, 6.5.0–6.5.3, 6.6.0–6.6.5, 6.7.0–6.7.10, 7.0.0–7.0.4, 7.1.0–7.1.9, 7.2.0–7.2.7, 7.3.0–7.3.5, 7.4.0–7.4.2, and 7.5.0–7.5.1; FortiSIEM 7.6 is not affected. The vulnerability was disclosed on October 13, 2026, and was responsibly reported by external researcher khalooda0x (Khaled ibn Al-Walid). It carries a CVSS v3.1 base score of 3.4–3.8 (Low severity) (Fortinet PSIRT, GitHub Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the FortiSIEM GUI fails to perform adequate authorization checks when an authenticated actor attempts to access certain resources or execute specific actions. An attacker with high-privilege network access can send specially crafted HTTP requests to the FortiSIEM GUI to trigger unauthorized code or command execution. Exploitation requires prior authentication with elevated privileges, limiting the attack surface to insiders or accounts that have already been compromised. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (Fortinet PSIRT, GitHub Advisory).

Successful exploitation allows an authenticated high-privilege attacker to execute unauthorized code or commands on the FortiSIEM system, resulting in limited integrity and availability impacts. Confidentiality is not directly impacted according to the CVSS scoring. Because FortiSIEM is a security information and event management platform, unauthorized command execution could disrupt log collection, tamper with security event data, or degrade monitoring capabilities across the environment (Fortinet PSIRT, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. Fortinet has confirmed the vulnerability is not known to be exploited (Known Exploited: No). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation requires high privileges and network access, further reducing practical risk (Fortinet PSIRT, GitHub Advisory).

Fortinet recommends migrating affected FortiSIEM 7.5.x installations to a fixed release, as all versions in the 7.5 branch are affected and no in-branch patch is listed. FortiSIEM 7.6 is confirmed unaffected and represents the recommended upgrade target. As interim measures, administrators should restrict network access to the FortiSIEM GUI to trusted hosts only and monitor for anomalous HTTP requests targeting FortiSIEM administrative endpoints (Fortinet PSIRT).