CVE-2026-70467 Overview
CVE-2026-70467 is a server-side request forgery (SSRF) vulnerability [CWE-918] affecting multiple versions of Fortinet FortiSIEM. The flaw allows an authenticated attacker with high privileges to coerce the FortiSIEM server into issuing unauthorized requests, potentially leading to execution of unauthorized code or commands. The vulnerability is network-exploitable but requires high privileges and produces limited confidentiality and integrity impact. Fortinet documented the issue in the Fortinet Security Advisory FG-IR-26-159.
Critical Impact
An authenticated attacker can abuse the SSRF condition to make FortiSIEM issue arbitrary server-side requests, enabling unauthorized code or command execution against internal resources.
Affected Products
- Fortinet FortiSIEM 7.5.0, 7.4.0 through 7.4.2, and 7.3.0 through 7.3.5
- Fortinet FortiSIEM 7.2, 7.1, and 7.0 (all versions)
- Fortinet FortiSIEM 6.7, 6.6, and 6.5 (all versions)
Discovery Timeline
- 2026-08-12 - CVE-2026-70467 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-70467
Vulnerability Analysis
The vulnerability is a server-side request forgery condition in FortiSIEM, Fortinet's security information and event management platform. An authenticated attacker holding high-privilege credentials can submit crafted input that causes the FortiSIEM backend to issue outbound requests on the attacker's behalf. Because the request originates from the FortiSIEM server, it can reach internal services normally shielded from external callers.
Fortinet's advisory indicates the flaw may enable execution of unauthorized code or commands. This elevates the risk beyond typical SSRF metadata exposure, since the coerced requests can target internal management interfaces or command endpoints.
Root Cause
The root cause is insufficient validation of user-controlled URLs or hostnames passed to a server-side HTTP client within FortiSIEM. Without allowlisting or scheme restriction, the application forwards requests to attacker-specified destinations, matching the pattern described in CWE-918: Server-Side Request Forgery.
Attack Vector
Exploitation requires network access to the FortiSIEM management interface and valid high-privilege credentials. The attacker submits a request containing a manipulated URL parameter. FortiSIEM then dispatches the request server-side, potentially reaching cloud metadata endpoints, loopback services, or internal command APIs. Refer to the Fortinet Security Advisory FG-IR-26-159 for vendor-specific exploitation notes.
Detection Methods for CVE-2026-70467
Indicators of Compromise
- Outbound HTTP or HTTPS connections originating from the FortiSIEM appliance to unexpected internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Anomalous authenticated administrative sessions from unusual source addresses interacting with FortiSIEM API endpoints.
- Unexpected process spawns or command executions on the FortiSIEM host correlated with API requests.
Detection Strategies
- Inspect FortiSIEM application logs for URL parameters containing internal, private, or link-local addresses submitted by authenticated users.
- Monitor egress traffic from FortiSIEM appliances and alert on connections that deviate from documented integration destinations.
- Correlate high-privilege user activity with server-initiated outbound requests to detect SSRF abuse patterns.
Monitoring Recommendations
- Enable verbose audit logging on FortiSIEM administrative APIs and forward events to a centralized SIEM or data lake.
- Baseline normal outbound connection patterns from FortiSIEM and alert on deviations, particularly to RFC1918 and metadata ranges.
- Track privileged account usage and require review of any configuration changes involving external URL inputs.
How to Mitigate CVE-2026-70467
Immediate Actions Required
- Review the Fortinet Security Advisory FG-IR-26-159 and apply the fixed FortiSIEM release identified for your branch.
- Restrict network access to the FortiSIEM management interface to trusted administrative subnets only.
- Rotate high-privilege FortiSIEM credentials and audit administrator accounts for unauthorized additions.
Patch Information
Fortinet has published remediation guidance in advisory FG-IR-26-159. Upgrade affected FortiSIEM 7.5, 7.4, 7.3, 7.2, 7.1, 7.0, 6.7, 6.6, and 6.5 deployments to the versions listed in the advisory. Consult the vendor page for the exact fixed builds per branch.
Workarounds
- Enforce egress filtering on the FortiSIEM appliance to block outbound requests to internal, loopback, and cloud metadata ranges when patching is not immediately possible.
- Limit assignment of high-privilege FortiSIEM roles and enforce multi-factor authentication for administrative accounts.
- Place the FortiSIEM management interface behind a jump host or VPN to reduce exposure of the authenticated attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
