# CVE-2026-59838: Fortinet FortiSIEM XSS in Domain parameter

Source: https://junglewise.ai/threats/cve-2026-59838-fortinet-fortisiem-xss-in-domain-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-59838 · Severity: medium · CVSS 5.9 · Published 2026-07-15

FortiSIEM is a security management platform used by organizations to monitor and respond to security events across their networks. A vulnerability in its web interface could allow a high-privileged administrator to inject malicious scripts into the system. If another user views the affected page, the attacker could potentially execute unauthorized actions or access sensitive information within the management console.

Technologies: [Fortinet Fortisiem](https://junglewise.ai/threats/technologies/fortisiem). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-59838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59838 being exploited in the wild.

**How severe is CVE-2026-59838?** Medium severity, with a CVSS score of 5.9, published 15 July 2026.

**Which products and versions are affected?** Fortinet Fortisiem 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions.

**Is there a fix for CVE-2026-59838?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59838 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59838?** Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A basic Cross-Site Scripting (XSS) vulnerability exists in Fortinet FortiSIEM due to improper neutralization of script-related HTML tags in the 'Domain' parameter of the GUI. The vulnerability (CWE-80) requires an attacker to have high-level administrative privileges (PR:H) and involves user interaction (UI:R) from another user. By sending a crafted request, an authenticated attacker can inject malicious scripts that execute in the context of the victim's browser session. This could lead to unauthorized command execution or information disclosure within the web management interface. Users are advised to upgrade to versions 7.4.1, 7.3.5, 7.2.7, or later.

## Affected products

- Fortinet FortiSIEM 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions

## Timeline

- 2026-07-14: advisory: Initial publication by Fortinet (FG-IR-26-149)
- 2026-07-15: disclosed: CVE-2026-59838 published to NVD

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-149](https://fortiguard.fortinet.com/psirt/FG-IR-26-149)

## Related threats

- [Fortinet FortiSIEM path traversal in grpc phQueryMaster](https://junglewise.ai/threats/cve-2026-106173-a-improper-limitation-of-a-pathname-to-a-restricted-directory)
- [Fortinet FortiSIEM open redirect vulnerability](https://junglewise.ai/threats/cve-2026-84389-fortinet-fortisiem-open-redirect-vulnerability)
- [A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2…](https://junglewise.ai/threats/cve-2026-70467-a-server-side-request-forgery-ssrf-vulnerability-in-fortinet)
- [An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.](https://junglewise.ai/threats/cve-2025-58324-an-improper-neutralization-of-input-during-web-page-generation)