FortiSOAR CVE-2025-59808

Exploitation requires the attacker to ALREADY have authenticated access to the victim's FortiSOAR user account (CVSS PR:L) - for example a valid session, stolen token, or hijacked login; this is a post-authentication flaw, not remote-unauthenticated. The specific weakness is that the account credential/password-change function does NOT prompt for or verify the account's current password before applying the change (CWE-620). Limiting factors: the attacker gains nothing without prior account access, there is no confidentiality impact (C:N), and the vendor rates attack complexity high (AC:H); impact is primarily account takeover hardening/lockout (I:H, A:H) across FortiSOAR 7.3 through 7.6.2 (both PaaS and on-premise).

This is a moderate, context-dependent risk rather than a top-priority emergency. The CVSS 3.1 base score of 6.8 (Medium) reflects an authenticated flaw: the vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H requires the attacker to already possess low-privilege access to the victim's account (PR:L), which per the description is the central precondition - this is a post-compromise persistence/account-takeover-hardening issue (CWE-620, unverified password change), not an initial-access vulnerability. Signals are consistent and point LOW on the urgency scale: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so this is best characterized as 'no public exploit identified at time of analysis.' The reporter is Fortinet PSIRT (psirt@fortinet.com) with an official FortiGuard advisory, so the vulnerability itself is vendor-confirmed even though exploitation is not. One internal inconsistency to flag: the input Tags include 'Information Disclosure,' but the CVSS vector explicitly sets C:N (no confidentiality impact) and the CWE is unverified password change affecting integrity and availability - so the 'Information Disclosure' categorization is not supported by the vector and should be disregarded. Bottom line: a real but gated issue whose impact is realized only after an account is already compromised.

An attacker who has already hijacked a FortiSOAR user session (e.g., via a stolen token, phishing, or a shared workstation) navigates to the credential-change function and resets the account password without being prompted to confirm the current password. This lets them lock out the legitimate user and entrench persistent control of the account. No public proof-of-concept exploit was identified in the provided data.