FortiSIEM has a missing authorization issue in its GUI that allows logged-in users to run unauthorized code via crafted requests.
Key points
- The flaw affects the FortiSIEM graphical user interface.
- Attackers need valid credentials to exploit this vulnerability.
- The issue carries a CVSS score of 3.4, rated as low severity.
Fortinet disclosed a broken authorization vulnerability in its FortiSIEM security information and event management product. The flaw exists in the graphical user interface and allows authenticated attackers to execute unauthorized code or commands through specially crafted HTTP requests.
What happened
FortiGuard PSIRT published an advisory regarding a missing authorization vulnerability, identified as CWE-862, within the FortiSIEM GUI. According to the official advisory, this flaw permits an attacker who already has valid credentials to execute unauthorized code or commands. The exploitation method involves sending specially crafted HTTP requests to the affected interface.
The vendor assigned a CVSSv3 score of 3.4 to this issue. This score places the vulnerability in the low severity range. The advisory was revised on October 13, 2026. The report specifies that the attacker must be authenticated to leverage this weakness, meaning anonymous access is not a vector for exploitation.
The fix
The source material does not state whether a patch or update exists. Organizations should monitor for unusual activity within their FortiSIEM instances. Teams should restrict administrative access to the GUI and ensure that only necessary personnel hold valid credentials. Reviewing access logs for unexpected command executions is a prudent interim measure.
Why it matters
Broken authorization occurs when an application fails to properly verify that a user has the right to perform a specific action. In this context, having a valid login does not automatically grant permission to execute arbitrary code. Teams usually implement role-based access controls to limit what authenticated users can do. Check whether your systems enforce strict permissions for administrative functions. Ensure that web interfaces validate every request against the user’s specific privileges. This prevents insiders or compromised accounts from escalating their access beyond intended limits.
What to do and how to stay safe: Fortinet
- Verify that all FortiSIEM GUI accounts use strong, unique credentials to reduce the risk of account takeover.
- Monitor server logs for unusual HTTP requests or command executions from authenticated users that do not match normal operational patterns.
- Restrict network access to the FortiSIEM GUI to only trusted IP addresses or internal network segments.
- Review user permissions regularly to ensure that no single account has excessive privileges that could be abused if compromised.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability critical or high severity?
No, the CVSSv3 score is 3.4, which is considered low severity.
Can an attacker exploit this without logging in?
No, the advisory states that the attacker must be authenticated to execute the unauthorized code.
What is the specific technical classification of this flaw?
It is classified as CWE-862, which is a missing authorization vulnerability.
