Fortisoar Paas EUVD-2026-22319

The CVSS 6.5 score reflects a remote network attack vector with low complexity and low privilege requirements (PR:L), confidentiality impact marked high, but no integrity or availability impact. The requirement for authentication (PR:L) means only logged-in users or accounts with valid credentials can trigger the disclosure-this moderates the risk compared to unauthenticated cleartext leaks. However, the high confidentiality impact (C:H) is significant: leaked authentication tokens or API keys could enable lateral movement or escalation. The broad version range (7.3-7.6.x across both platforms) suggests a design or configuration issue affecting multiple releases. The absence of public exploit code or confirmed active exploitation suggests this is not yet a priority target, but the ease of exploitation (simple network sniffing) and the value of stolen credentials make this a real operational concern. Organizations should prioritize patching based on exposure (network-facing FortiSOAR instances are at higher risk) rather than treating this as critical enterprise-grade threat.

An authenticated user or internal analyst at a company running FortiSOAR connects to the platform over an untrusted network (coffee shop WiFi, shared corporate network). An attacker positioned on the same network passively captures HTTP traffic between the analyst's browser and the FortiSOAR server, intercepting API tokens or session cookies transmitted in cleartext. The attacker reuses these credentials to access FortiSOAR as that user, extracting case data, connector API keys, or other sensitive intelligence stored in the platform.