Is CVE-2026-59838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59838 being exploited in the wild.

How severe is CVE-2026-59838?

Medium severity, with a CVSS score of 5.9, published 15 July 2026.

Which products and versions are affected?

Fortinet Fortisiem 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions.

Is there a fix for CVE-2026-59838?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59838 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59838?

Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59838: Fortinet FortiSIEM XSS in Domain parameter

CVE-2026-59838 · Severity: medium · CVSS 5.9 · Published 2026-07-15

FortiSIEM is a security management platform used by organizations to monitor and respond to security events across their networks. A vulnerability in its web interface could allow a high-privileged administrator to inject malicious scripts into the system. If another user views the affected page, the attacker could potentially execute unauthorized actions or access sensitive information within the management console.

Technologies: Fortinet Fortisiem. Vendors: Fortinet.

Quick answers

Is CVE-2026-59838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59838 being exploited in the wild.
How severe is CVE-2026-59838?: Medium severity, with a CVSS score of 5.9, published 15 July 2026.
Which products and versions are affected?: Fortinet Fortisiem 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions.
Is there a fix for CVE-2026-59838?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59838 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59838?: Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A basic Cross-Site Scripting (XSS) vulnerability exists in Fortinet FortiSIEM due to improper neutralization of script-related HTML tags in the 'Domain' parameter of the GUI. The vulnerability (CWE-80) requires an attacker to have high-level administrative privileges (PR:H) and involves user interaction (UI:R) from another user. By sending a crafted request, an authenticated attacker can inject malicious scripts that execute in the context of the victim's browser session. This could lead to unauthorized command execution or information disclosure within the web management interface. Users are advised to upgrade to versions 7.4.1, 7.3.5, 7.2.7, or later.

Affected products

Fortinet FortiSIEM 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions

Timeline

2026-07-14: advisory: Initial publication by Fortinet (FG-IR-26-149)
2026-07-15: disclosed: CVE-2026-59838 published to NVD

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-149

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.