CVE-2026-16467 is a missing authorization vulnerability in Fortilogger, fixed in version 6.1.5.9. The NVD describes it as 'accessing functionality not properly constrained by ACLs' — deliberately vague language that obscures the real risk. The CVSS 7.5 score and EPSS of 0.00293 will lead many organizations to deprioritize this patch. That would be a mistake, because the EPSS model measures automated exploit probability, not the threat scenario that actually matters for this vulnerability class.
Fortilogger is audit infrastructure. When an unauthorized user can access a logging platform, the damage extends far beyond data exfiltration — they contaminate the evidentiary chain itself. Once an attacker has access to your audit tool, every log entry written after that access becomes suspect. You cannot use those logs to reconstruct the breach, because the breach includes compromising the mechanism you'd use to detect it. This creates what analysts call a forensic singularity: the vulnerability doesn't just expose data, it poisons the very records you'd use to determine whether the vulnerability was exploited at all.
This is precisely how sophisticated adversaries operate. APT actors don't target logging infrastructure opportunistically — they target it strategically, precisely because it covers their tracks on every other operation. The EPSS score will never capture this threat model. Organizations that gate their patching cadence on automated exploitability scores are making decisions based on a threat scenario that doesn't match the actual risk.
There is also a structural question worth answering before you trust this as a one-off fix. Fortilogger almost certainly began as an internal tool where the security assumption was implicit: 'domain-joined admins can reach this, so authorization is someone else's problem.' That assumption got baked into the architecture, then the tool got productized — and nobody went back to excavate the foundational trust model. The fix in 6.1.5.9 either closes one specific path that a researcher found, or it represents a systematic audit of the authorization layer. If it's the former, treat this as the first of a series and prioritize accordingly.
Concrete actions: patch to 6.1.5.9 immediately regardless of EPSS. Assume the 'functionality' access includes the ability to delete or modify audit records. Review historical Fortilogger access logs for any unauthorized sessions predating the patch — if you find suspicious activity, recognize that the evidentiary integrity of those logs is compromised and supplement with independent verification. If you have moderate security maturity and have been deprioritizing this based on EPSS, that is exactly the population where this vulnerability causes the most damage.