FORTINET WARNS OF FORTISIEM PRE-AUTH RCE FLAW WITH EXPLOIT IN THE WILD

Summary from the TLDR InfoSec newsletter

Fortinet is warning of a new critical (CVSS 9.8/10) pre-auth remote code execution vulnerability affecting multiple branches of FortiSIEM. The vulnerability is an OS command injection caused by “improper neutralization of special elements.” Fortinet has also stated that working exploit code is publicly available and urges immediate remediation.