Fortisoar Paas CVE-2026-21742

The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates network-accessible attack with low complexity, but requires prior authentication and user interaction. EPSS data is not provided, limiting probability assessment, but the combination of signals suggests moderate real-world risk: authentication requirement and UI interaction raise the bar for exploitation, yet once authenticated, credential disclosure is trivial and deterministic. The vulnerability is not listed as a CISA KEV, and no public exploit code is documented in the provided intelligence, indicating this is not actively exploited at scale. However, the impact is high for organizations using these connectors-if an authenticated administrator or SOC analyst is compromised or disgruntled, they can trivially extract passwords for downstream integrations. The scope is unchanged (S:U), meaning the attack does not breach other security boundaries. Prioritize patching in environments where FortiSOAR credentials or downstream system credentials (via Secure Message Exchange or RADIUS) are sensitive.

An authenticated FortiSOAR administrator logs into the platform and navigates to the Secure Message Exchange or RADIUS connector configuration page. An attacker with network access (e.g., via a compromised network tap, ARP spoofing, or DNS hijacking on a shared network) or an insider threat intercepts the unencrypted API response containing the plaintext password. Alternatively, a disgruntled authorized user simply requests the connector configuration via API and extracts the password, then uses it to pivot to downstream systems or external services that rely on the same credentials.