Fortinet revises two FortiSIEM advisories, one CVSS 9.4

Fortinet revised two FortiSIEM advisories on 2026-10-13: a CVSS 9.4 unauthenticated path traversal and a CVSS 3.4 authenticated authorization flaw, with no exploitation stated.

Fortinet published two separate FortiSIEM PSIRT advisories, both revised on 2026-10-13. FG-IR-26-180 covers an improper pathname limitation (CWE-22), described as an arbitrary file write in grpc phQueryMaster and scored CVSS 9.4; unauthenticated attackers may run unauthorized code or commands with specially crafted packets. FG-IR-26-183 covers a missing-authorization issue (CWE-862) in the FortiSIEM GUI, scored CVSS 3.4, that an authenticated attacker may abuse with specially crafted HTTP requests. Neither advisory states a CVE identifier or reports observed exploitation. The reports do not conflict; they describe distinct flaws of very different severity and access requirements.

• Fortinet PSIRT advisory FG-IR-26-180 describes an arbitrary file write in FortiSIEM grpc phQueryMaster, an improper pathname limitation (CWE-22) scored CVSS 9.4.
• An unauthenticated attacker may execute unauthorized code or commands using specially crafted packets.
• Fortinet PSIRT advisory FG-IR-26-183 describes a missing-authorization flaw (CWE-862) in the FortiSIEM GUI, scored CVSS 3.4.
• An authenticated attacker may execute unauthorized code or commands by sending specially crafted HTTP requests.
• Neither advisory lists a CVE identifier or states that exploitation has been observed.
• Both advisories were revised on 2026-10-13.