EUVD-2026-22325Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
AnalysisAI
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Technical ContextAI
FortiSOAR is a security orchestration, automation, and response (SOAR) platform that integrates with third-party security tools via connectors. Each connector stores authentication credentials (API keys, passwords) to interact with external systems. The vulnerability stems from CWE-257 (Storing Passwords in a Recoverable Format), where connector credentials are not properly encrypted or are stored in a manner that allows decryption or retrieval without proper access controls. An authenticated user can exploit this by modifying the connector's server address configuration, triggering a retrieval or re-encoding of stored credentials in plaintext or weakly protected form. The vulnerability affects both the cloud-hosted PaaS deployment model and on-premise installations across multiple minor versions (7.3.x, 7.4.x, 7.5.x, 7.6.x).
RemediationAI
Fortinet has issued patches for affected versions; apply the latest available FortiSOAR updates for your deployment model (PaaS or on-premise). For on-premise deployments, upgrade to the latest 7.6.x, 7.5.x, or 7.4.x release after 7.6.4, 7.5.2, or 7.4.5 respectively. For PaaS, Fortinet will roll out patched versions automatically per their service model. As an interim mitigation, restrict connector configuration modification to privileged users only and audit existing connector credentials for unauthorized retrieval. Rotate credentials for all connectors managed by FortiSOAR, particularly those with sensitive downstream access. Consult https://fortiguard.fortinet.com/psirt/FG-IR-26-104 for exact patched version numbers and deployment-specific remediation steps.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Same weakness CWE-257 – Storing Passwords in a Recoverable Format
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today