EUVD-2026-22325Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
AnalysisAI
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Technical ContextAI
FortiSOAR is a security orchestration, automation, and response (SOAR) platform that integrates with third-party security tools via connectors. Each connector stores authentication credentials (API keys, passwords) to interact with external systems. The vulnerability stems from CWE-257 (Storing Passwords in a Recoverable Format), where connector credentials are not properly encrypted or are stored in a manner that allows decryption or retrieval without proper access controls. An authenticated user can exploit this by modifying the connector's server address configuration, triggering a retrieval or re-encoding of stored credentials in plaintext or weakly protected form. The vulnerability affects both the cloud-hosted PaaS deployment model and on-premise installations across multiple minor versions (7.3.x, 7.4.x, 7.5.x, 7.6.x).
RemediationAI
Fortinet has issued patches for affected versions; apply the latest available FortiSOAR updates for your deployment model (PaaS or on-premise). For on-premise deployments, upgrade to the latest 7.6.x, 7.5.x, or 7.4.x release after 7.6.4, 7.5.2, or 7.4.5 respectively. For PaaS, Fortinet will roll out patched versions automatically per their service model. As an interim mitigation, restrict connector configuration modification to privileged users only and audit existing connector credentials for unauthorized retrieval. Rotate credentials for all connectors managed by FortiSOAR, particularly those with sensitive downstream access. Consult https://fortiguard.fortinet.com/psirt/FG-IR-26-104 for exact patched version numbers and deployment-specific remediation steps.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-257 – Storing Passwords in a Recoverable Format
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today