Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
FortiSIEM: Hackers Can Use Spoofed URLs to Steal Data
CVE-2026-25972
Summary
FortiSIEM versions 7.3.0 through 7.3.4 have a security weakness that makes it possible for an attacker to trick users into revealing sensitive information. This happens when a user clicks on a fake link sent by the attacker. Fortinet should be updated to the latest version to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| fortinet | fortisiem | > 7.3.0 , <= 7.3.5 | – |
| fortinet | fortisiem | 7.4.0 | – |
Original title
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated a...
Original description
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated attacker to provide arbitrary data enabling a social engineering attack via spoofed URL parameters.
nvd CVSS3.1
4.3
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 10 Mar 2026 · Updated: 14 Mar 2026 · First seen: 11 Mar 2026