EUVD-2026-22317
GHSA-p356-hfrx-f579
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests.
AnalysisAI
Stored cross-site scripting (XSS) in Fortinet FortiSOAR allows authenticated remote attackers to inject malicious scripts via crafted HTTP requests, affecting both PaaS and on-premise deployments across versions 7.3 through 7.6.3. The vulnerability requires user interaction to trigger the payload and results in limited confidentiality and integrity impact, with a CVSS score of 4.6 reflecting the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
This vulnerability represents improper input neutralization during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). FortiSOAR is a security orchestration, automation, and response (SOAR) platform developed by Fortinet, available in both cloud-based PaaS and on-premise deployment models. The affected CPE strings encompass cpe:2.3:a:fortinet:fortisoar_paas and cpe:2.3:a:fortinet:fortisoar_on-premise. An attacker with valid credentials can supply specially crafted input that bypasses output encoding mechanisms, allowing malicious JavaScript to be stored in the application and executed in the context of other users' browsers when they view affected content.
RemediationAI
Upgrade FortiSOAR on-premise to version 7.5.3 or later, or 7.6.4 or later for PaaS deployments, depending on which major version branch is deployed. Customers unable to immediately patch should restrict administrative access to trusted users only and implement network-level access controls limiting who can authenticate to FortiSOAR instances. Input validation and output encoding reviews should be performed on custom workflows or integrations that process user-supplied data. Fortinet's official guidance and patch availability confirmation is provided in advisory FG-IR-26-117 at https://fortiguard.fortinet.com/psirt/FG-IR-26-117.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today