Fortinet FortiSOAR CVE-2026-84385

Authentication is required: exploitation demands a valid FortiSOAR user account with low-privilege role membership (CVSS PR:L). The vulnerability is reachable over the network without additional complexity or user interaction, meaning any network-accessible FortiSOAR deployment is in scope. Both PaaS (cloud-hosted) and on-premise deployments are affected. The specific feature or configuration that must be active to trigger the vulnerability is unknown due to an unfilled placeholder in the vendor description; defenders cannot rule out default-configuration exposure. Exploitation is limited to confidentiality-low and integrity-low impacts within the FortiSOAR system only (S:U, no lateral scope change). There is no availability impact component.

The CVSS 3.1 base score of 5.4 (Medium) reflects the realistic risk profile: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. An authenticated low-privilege user with network access to the FortiSOAR interface can exploit this without complexity or user interaction, gaining limited incremental read and write access. Despite the broad affected version range (four major branches, both deployment types), the impact ceiling is constrained by S:U (unchanged scope) and L-rated C/I metrics, indicating partial rather than full compromise. No EPSS score is provided in the input, KEV status is absent, and no POC is publicly identified - all suggesting this has not seen broad opportunistic exploitation as of analysis time. The primary real-world risk is insider threat or credential-compromise scenarios where an attacker who has obtained a low-privilege FortiSOAR account uses this flaw to access data or functionality beyond their intended role. The incomplete description (placeholder text) prevents precise impact scoping, reducing confidence in severity calibration.

An attacker who has obtained low-privilege credentials to a FortiSOAR instance - through phishing, credential stuffing, or an insider account - authenticates over the network to the FortiSOAR web interface or API. They invoke an undisclosed API endpoint or platform feature that does not correctly verify role boundaries, gaining read or write access to data or operations reserved for higher-privilege roles. No public exploit code is identified at time of analysis, so exploitation likely requires knowledge of the specific unguarded endpoint.