CVE-2026-70467

Executive Summary

CVE-2026-70467 is a server-side request forgery (SSRF) vulnerability in Fortinet FortiSIEM affecting every supported lineage from 6.5.0 through 7.5.0. Per the NVD description, an attacker who already holds high-privileged access to an affected FortiSIEM console can leverage this flaw to issue unauthorized internal requests, with the record further indicating that exploitation "may allow attacker to execute unauthorized code or commands." As of this report, no vendor patch has been published (patch confidence 0/4), no CISA KEV listing exists, and no public exploit code, Nuclei template, or in-the-wild campaign has been confirmed. The CVSS base score is 3.8 (low), constrained by the high-privilege precondition and low confidentiality/integrity impact.

Technical Analysis

FortiSIEM is an enterprise SIEM platform that aggregates, normalizes, and correlates log and telemetry data from network devices, servers, endpoints, and cloud services. The NVD description for CVE-2026-70467 is minimal: it identifies the affected product and version range, classifies the flaw as CWE-918 (SSRF), and notes potential unauthorized code/command execution. Notably, the published description ends with an incomplete placeholder ("via "), meaning the vendor/CNA has not yet disclosed the specific trigger mechanism — no vulnerable function names, URL paths, request parameters, or module identifiers are available in the public record. Per the accuracy constraints of this report, implementation-level specifics are therefore not inventoried, and the flaw is characterized at the vulnerability-class level.

A server-side request forgery exists when an application fetches a remote resource based on attacker-influenced input without adequately validating the target host, scheme, or port. In a SIEM product, legitimate functions that retrieve external resources — threat-intelligence feed ingestion, enrichment lookups, remote collector health checks, or integration webhooks — are natural SSRF surfaces. In this case, the vulnerable functionality sits behind an authenticated, high-privileged interface (CVSS PR:H), indicating an authenticated administrator or similarly privileged role is required to reach it rather than an unauthenticated internet-facing endpoint.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N yields a base score of 3.8 — Low severity. The network vector (AV:N) means the authenticated attacker can trigger the flaw remotely without physical access; complexity is Low; no user interaction is needed; and scope is unchanged (impact is contained to the SIEM host's trust boundary). Confidentiality and integrity impact are each Low, with no availability impact. The EPSS probability score is 0.00257 (17.6th percentile of scored CVEs), indicating a low modeled likelihood of exploitation in the wild — consistent with the high-privilege precondition.

The NVD assertion that SSRF "may allow attacker to execute unauthorized code or commands" is significant. SSRF alone yields only the ability to make server-side requests; reaching code/command execution requires a secondary vector, such as the forged request hitting an internal management/API service, an internal service that renders or processes attacker-controlled content, or a service exposing a command-execution primitive on loopback or the internal network. The public record does not identify that secondary service. This characterization should be treated as an inferred chain, not a confirmed mechanism, until Fortinet publishes a complete advisory.

The attack surface is FortiSIEM's web-facing management and server-side data-ingestion components running on any of the listed versions. Because the affected range spans more than ten minor versions across two major architectural generations (6.x and 7.x), the flaw likely resides in shared server-side request-handling logic rather than a feature introduced in a single release. Insufficient technical detail is available to narrow the vulnerable component further.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-70467; the attack chain below is inferred strictly from the vulnerability class, the NVD description, and CVSS attributes.

1. Reconnaissance / target identification. Because exploitation requires High privileges (PR:H), the attacker must first obtain a valid administrator-level account on an affected FortiSIEM instance. Attackers typically identify exposed FortiSIEM consoles via internet-wide scanning (see Shodan dorks in METADATA), then attempt credential stuffing, brute force, phishing, or reuse of credentials obtained from prior breaches. Version fingerprinting of the login portal or exposed headers confirms whether the target falls within 6.5.0 – 7.5.0.

2. Flaw-class trigger. With privileged access, the attacker submits input to a vulnerable server-side request function, causing the FortiSIEM server to issue an HTTP request to a destination of the attacker's choosing. Class-level examples include embedding an internal IP literal, hostname, or non-HTTP scheme into the input the application uses to construct an outbound request. The NVD record does not identify the specific parameter; this step is an inference from the SSRF class.

3. Payload / execution method. At the vulnerability-class level, payloads for SSRF probe internal targets: loopback (127.0.0.0/8), RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local/cloud metadata (169.254.169.254), and, depending on the URL-handling library, alternate schemes such as file://, gopher://, or dict://. If the SSRF reaches an internal service capable of executing commands — per the NVD description's "unauthorized code or commands" language — the attacker may achieve limited code execution in the context of the FortiSIEM service account. No specific payload strings, endpoints, or internal service names are publicly known.

4. Post-exploitation impact. The CVSS subscores cap the direct impact at Low confidentiality (reading responses from internal resources, e.g., cloud metadata or internal admin interfaces) and Low integrity (limited tampering via internal state-changing requests). If the SSRF-to-code-execution chain is confirmed, the impact broadens: an attacker with code execution on the SIEM server could tamper with collected security telemetry, blind the SOC, or use the SIEM host as a pivot point into the internal network. No public evidence currently indicates this chain has been weaponized.

Impact Assessment

FortiSIEM is a central security-monitoring and log-correlation platform; its compromise is operationally significant to enterprises because it can conceal malicious activity and enable further internal movement. In this case, the business impact is moderated by three factors: (a) the attacker must already hold a high-privileged account, (b) the CVSS scope is unchanged with only Low confidentiality and Low integrity impact, and (c) the current EPSS probability is very low (0.00257).

Affected systems include every FortiSIEM deployment running 6.5, 6.6, 6.7, 7.0, 7.1, or 7.2 (all versions), 7.3.0–7.3.5, 7.4.0–7.4.2, or 7.5.0. The blast radius extends to the internal network segments reachable from the FortiSIEM server, including cloud metadata endpoints and internal management interfaces of other systems, since the SSRF allows the server to probe hosts that external attackers could not otherwise reach. The integrities of the SIEM's own collector configuration, log-store contents, and downstream reporting are all within the potential integrity-impact envelope. Organizations running FortiSIEM in a public-cloud environment should treat the cloud metadata endpoint (169.254.169.254) as a high-value SSRF target.

Detection Guidance

Because no exploit artifacts or hard-coded IOCs are publicly available, detection is necessarily behavioral and focuses on anomalous outbound requests originating from FortiSIEM hosts — particularly requests to loopback, RFC1918, and link-local/cloud-metadata addresses, and unusual URI schemes in the SIEM's web server or egress proxy logs. Analysts should scope the rules below to the specific FortiSIEM server IPs in their environment and tune the destination allowlist, since FortiSIEM legitimately connects to collectors and external feeds.

Sigma Rule

title: FortiSIEM SSRF Outbound Request to Internal or Link-Local Addresses
id: 7f1d9f3a-2c4e-4c8f-9f1b-3a5d6e7f8a9b
status: experimental
description: Detects outbound HTTP request events originating from a FortiSIEM host to loopback, RFC1918, or cloud-metadata ranges, consistent with SSRF exploitation of CVE-2026-70467
author: Valters IT Threat Intelligence
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70467
    - https://cwe.mitre.org/data/definitions/918.html
logsource:
    category: proxy
    product: generic
detection:
    selection_src:
        src_ip|cidr:
            - <FORTSIEM_SERVER_IP_RANGES>  # replace with your SIEM server egress scope
    selection_dst:
        dst_ip|cidr:
            - 127.0.0.0/8
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
            - 169.254.169.254/32
    selection_url:
        url|contains:
            - "169.254.169.254"
            - "localhost"
            - "file://"
            - "gopher://"
    condition: selection_src and (selection_dst or selection_url)
falsepositives:
    - Legitimate FortiSIEM connectivity checks to internal collectors or management interfaces
    - URL-scanning or enrichment lookups that intentionally resolve internal hosts
level: high

YARA Rule

rule fortisiem_ssrf_cve_2026_70467
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects SSRF indicator strings in FortiSIEM web server logs, proxy logs, and process memory consistent with CVE-2026-70467 exploitation"
        cve = "2026-70467"
        cwe = "918"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70467"
        date = "2026-01-01"
    strings:
        $meta_endpoint = "169.254.169.254"
        $loopback1 = "127.0.0.1"
        $loopback2 = "localhost"
        $scheme_file = "file://"
        $scheme_gopher = "gopher://"
        $scheme_dict = "dict://"
        $priv10 = "http://10."
        $priv192 = "http://192.168."
        $priv172a = "http://172.16."
        $priv172b = "http://172.17."
        $priv172c = "http://172.31."
    condition:
        uint16(0) == 0x0A0D or any of ($meta_endpoint, $loopback1, $loopback2, $scheme_file,
                                          $scheme_gopher, $scheme_dict, $priv10, $priv192,
                                          $priv172a, $priv172b, $priv172c)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-70467 FortiSIEM SSRF - Outbound Request to Internal Address"; flow:to_server,established; content:"GET"; http.method; nocase; content:"./"; http.uri; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost)/Ui"; sid:27046701; rev:1; classtype:attempted-admin; metadata:created_at 2026_01_01, cve 2026-70467;)

alert http $HOME_NET any -> [10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8] any (msg:"CVE-2026-70467 FortiSIEM SSRF - Request to RFC1918/Loopback Destination"; flow:to_server,established; content:"Host"; http.header_names; nocase; content:"GET"; http.method; sid:27046702; rev:1; classtype:attempted-admin; metadata:created_at 2026_01_01, cve 2026-70467;)

Note: fire these rules only on traffic egressing the asset group containing FortiSIEM servers to control false positives. Inspect HTTP response bodies for internal-service data exfiltration patterns (e.g., cloud metadata JSON like "iam/security-credentials").

Elastic Detection

network where
  (host.name : "*fortisiem*" or tags : "fortisiem") and
  (
    CIDRMatch(destination.ip, "127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") or
    destination.ip == "169.254.169.254"
  ) and
  not (
    destination.port in (53, 123, 389, 636, 514)  // allowlist known collector/DC traffic
  )

If ECS network-level telemetry is unavailable in the FortiSIEM zone, correlate HTTP access logs for the same indicators:

http where
  (host.name : "*fortisiem*" or url.domain : "localhost" or url.domain : "169.254.169.254") and
  (url.full : ("gopher://*", "file://*", "http://10.*", "http://192.168.*", "http://172.16.*", "http://172.17.*", "http://172.31.*", "http://169.254.169.254*", "http://127.0.0.1*"))

Splunk SPL Query

index=proxy OR index=web
  src_ip=<FORTSIEM_SERVER_IP>
  (cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip)
   OR cidrmatch("192.168.0.0/16", dest_ip) OR cidrmatch("127.0.0.0/8", dest_ip)
   OR dest_ip="169.254.169.254")
  AND (url IN ("*169.254.169.254*","*localhost*","*file://*","*gopher://*","*dict://*"))
| stats count earliest(_time) latest(_time) by src_ip, dest_ip, url, http_user_agent
| where count > 1
| sort - _time

Replace index=proxy OR index=web with your actual outbound-proxy and web-server sourcetypes. Use the FortiSIEM server's egress IP as the anchor to avoid unrelated internal traffic.

Wazuh OSSEC Rule

<group name="fortisiem,ssrf,cve-2026-70467,">
  <rule id="100470" level="12">
    <if_sid>100469</if_sid>
    <field name="srcip">^<FORTSIEM_SERVER_IP>$</field>
    <regex>169\.254\.169\.254|127\.0\.0\.1|localhost|gopher://|file://|dict://</regex>
    <description>FortiSIEM (CVE-2026-70467) SSRF indicators detected in web/proxy logs: request to internal or link-local destination</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>
</group>

Attach this rule to the log decoder that normalizes FortiSIEM's web server or the enterprise egress proxy. Tune srcip to the actual FortiSIEM host so that legitimate internal scans are not alarmed; raise alert level if repeated against 169.254.169.254.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, hotfix, or fixed version has been observed in any tracked vendor or third-party source. Until Fortinet releases a fix, treat all listed versions as vulnerable.

1. Immediate mitigations:

   • Enforce egress allowlists at the firewall/proxy for the FortiSIEM server: permit only known collector IPs/ports, legitimate enrichment/feed endpoints, and management destinations; explicitly block 169.254.169.254 (cloud metadata), 127.0.0.0/8, and all RFC1918 egress not required for SIEM operations.
   • Apply strict access control to FortiSIEM administrative accounts: enable MFA, revoke unused accounts, and audit all accounts with high-privileged roles (the CVSS PR:H precondition means account hygiene is the primary control).
   • Isolate FortiSIEM in a dedicated security zone with north-south and east-west filtering, and restrict management-console access to jump hosts or VPN.
   • Deploy the detection rules above (Sigma/Suricata/Splunk) at the egress choke point, tuned to the FortiSIEM server's IP.

2. Patch/upgrade steps:

   • Monitor Fortinet PSIRT advisories (https://www.fortiguard.com/psirt) for a FortiSIEM security advisory covering CVE-2026-70467; no advisory is currently published.
   • When a fixed version is released, apply the upgrade during a maintenance window, validating collector compatibility first (FortiSIEM upgrades affect supervisor, workers, and collectors).
   • Re-check CISA KEV weekly; if CVE-2026-70467 is later added, escalate patching urgency and initiate emergency change management.

3. Long-term hardening:

   • Maintain an inventory of all FortiSIEM versions in the environment; given the 6.5 through 7.5 breadth, complete version coverage across both major architectures is required.
   • Add a WAF/reverse-proxy policy that rejects URLs containing IP literals, file://, gopher://, dict://, or the cloud-metadata host in any request to FortiSIEM's web-facing components.
   • Regularly validate and restrict any outbound URL-fetching configuration in FortiSIEM integrations (feeds, enrichment, webhooks); require allowlisted destinations.
   • Continue passive monitoring: watch NVD, vendor PSIRT, and exploit-db for the first public PoC, which is currently absent.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70467
• MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-70467
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• Fortinet PSIRT (vendor advisory portal — no advisory published for this CVE as of this report): https://www.fortiguard.com/psirt
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-70467 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns, exploit-in-the-wild evidence, or public exploit code referencing CVE-2026-70467 has been identified at the time of writing. The Fortinet advisory and full NVD description are expected to contain the currently placeholder attack-vector details ("") that are missing from the public record.