Fortisoar Paas CVE-2026-22574

CVSS 4.1 with vector AV:N/AC:L/PR:H/UI:N/S:C reflects low-to-moderate severity: network-accessible but requires high privileges (PR:H), low attack complexity, no user interaction, and cross-scope impact (S:C) limited to confidentiality (C:L). The required high-privilege authentication significantly constrains real-world exploitation, as only administrators with elevated access can trigger the vulnerability. However, the confidentiality impact is non-negligible-loss of LDAP service account credentials can enable lateral movement within directory infrastructure or privilege escalation if those credentials are reused elsewhere. The absence of public exploit code and KEV status suggests this is a low-priority vulnerability in enterprise environments with strong role-based access controls, though organizations with loose administrative access policies should treat it more seriously. The information disclosure nature and authenticated-only requirement place this in the 'patch when convenient' rather than 'critical emergency' category, despite network accessibility.

A malicious insider with FortiSOAR administrator privileges (e.g., a rogue security operations center analyst or compromised admin account) accesses the LDAP configuration panel and modifies the server address field. The modification triggers the vulnerability, exposing the LDAP service account password in a recoverable format. The attacker copies the credential and uses it to authenticate directly to the organization's Active Directory or LDAP directory, accessing sensitive user and group information or performing unauthorized directory modifications. No public exploit code has been identified; the attack requires direct access to the FortiSOAR interface.