Vulnerability

CERT-In Vulnerability Note CIVN-2026-0521
Directory Traversal Vulnerability in FortiSIEM

Original Issue Date:October 23, 2026

Severity Rating: CRITICAL

Software Affected

Fortinet FortiSIEM versions prior to 7.5.1

Overview

A directory traversal vulnerability has been reported in Fortinet FortiSIEM which could allow an unauthenticated remote attacker to execute arbitrary code or commands on the targeted system.

Target Audience:
Organizations and system administrators using Fortinet FortiSIEM.

Risk Assessment:
High risk of remote code execution, compromise of affected systems.

Impact Assessment:
Potential for unauthorized access to sensitive data, disruption of services.

Description

Fortinet FortiSIEM is a security information and event management (SIEM) solution used to collect, correlate, analyze, and monitor security events across an organizations IT infrastructure.

A directory traversal vulnerability exists in Fortinet FortiSIEM due to improper limitation of a pathname to a restricted directory. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted packets to the affected system.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code or commands on the targeted system.

Solution

Apply appropriate security updates and mitigations as recommended by the vendor.
https://fortiguard.fortinet.com/psirt/FG-IR-26-180

Vendor Information

Fortinet
https://fortiguard.fortinet.com/psirt/FG-IR-26-180

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-180

CVE Name
CVE-2026-106173

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India