{"vulnerability": "CVE-2026-55841", "sightings": [{"uuid": "36e05411-24cd-428c-ac85-013d0d22a3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mu7tx427gb2d", "content": "CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-55841/", "creation_timestamp": "2026-08-29T12:12:05.142909Z"}, {"uuid": "65968500-ce6e-4ef8-b9e6-fa1f6ce28f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117178730072615479", "content": "CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec\nhttps://www.valtersit.com/cve/CVE-2026-55841/", "creation_timestamp": "2026-08-29T12:12:07.334756Z"}, {"uuid": "99d652aa-293c-489f-bd19-084dd41f5475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu6l3wne2c22", "content": "\ud83d\udfe0 CVE-2026-55841 - High (7.5)\n\nGraylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55841/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-29T00:01:05.352939Z"}, {"uuid": "2ef39dc8-3d14-4823-81bf-2fb7043e5015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://gist.github.com/alon710/ebe5dde178b6da3fe2981f7349adc91f", "content": "# CVE-2026-55841: CVE-2026-55841: Log Evasion and Tampering in Graylog FortiGate Syslog Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55841\n\n## Summary\nA high-severity log evasion and tampering vulnerability in Graylog's FortiGate key-value syslog parser allows unauthenticated remote attackers to modify, delete, or overwrite critical security log fields, potentially bypassing security controls and monitoring systems.\n\n## TL;DR\nUnauthenticated attackers can inject specially crafted syslog packets containing specific key-value structures to strip or overwrite top-level log metadata like source IP addresses, timestamps, and routing info, enabling comprehensive defense evasion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-138: Improper Neutralization of Special Elements\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: N/A (Published 2026)\n- **Exploit Maturity**: PoC / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Log Tampering, Evasion of Security Monitoring, Data Loss\n\n## Affected Systems\n\n- Graylog Server\n- Graylog Forwarder\n- FortiGate Syslog Ingestion Pipeline\n- **Graylog Server**: < 6.3.12 (Fixed in: `6.3.12`)\n- **Graylog Server**: >= 7.0.0-alpha.1, < 7.0.7 (Fixed in: `7.0.7`)\n- **Graylog Server**: >= 7.1.0-alpha.1, < 7.1.2 (Fixed in: `7.1.2`)\n- **Graylog Forwarder**: < 7.3.0 (Fixed in: `7.3.0`)\n\n## Mitigation\n\n- Upgrade Graylog Server and Graylog Forwarder to fixed versions immediately.\n- Implement network-level Access Control Lists (ACLs) to restrict syslog input port access.\n- Configure generic raw inputs and parse fields via secure custom pipelines as a temporary alternative.\n\n**Remediation Steps:**\n1. Identify all Graylog Server and Forwarder nodes running FortiGate syslog input codecs.\n2. Apply the software updates to Graylog Server 6.3.12, 7.0.7, 7.1.2, or Graylog Forwarder 7.3.\n3. Restart the Graylog services and verify that the FortiGate inputs are operating using the updated codec.\n4. Verify log integrity by transmitting a simulated payload containing nested equals signs and confirming top-level fields are preserved.\n\n## References\n\n- [GHSA-gqr6-r77p-c2pj](https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-55841)\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55841)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T14:31:35.285589Z"}]}