First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-59841

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here>

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Fortinet	FortiSIEMWindowsAgent	>= 7.4.0, <= 7.4.1

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-155Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-598425.3A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length CVE-2026-598436.5A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later chan CVE-2026-598446.5A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh CVE-2026-598455.9A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals m CVE-2026-598463.9A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing envi CVE-2026-598477.5A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity prote CVE-2026-598485.3A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely,CVE-2026-598497.5A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinit CVE-2026-59857.3A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file CVE-2026-598507.5A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associa CVE-2026-598518.8A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerbe CVE-2026-598536.5SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search cr

CVE-2026-59841: High severity, CVSS 7.5 | Vulnix