EUVD-2026-22323Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration.
AnalysisAI
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Technical ContextAI
Fortinet FortiSOAR is a cloud-native security orchestration, automation, and response (SOAR) platform used for incident response and alert management. The vulnerability stems from improper credential storage (CWE-257) in the LDAP configuration subsystem. Rather than encrypting or hashing LDAP service account passwords with strong cryptographic practices, FortiSOAR stores them in a recoverable format-likely plaintext or with reversible encryption. When an authenticated administrator modifies the LDAP server address field, the system may expose or leak the stored credential, allowing credential retrieval. This affects both the cloud-hosted PaaS deployment model (cpe:2.3:a:fortinet:fortisoar_paas) and the on-premise variant (cpe:2.3:a:fortinet:fortisoar_on-premise), impacting a wide range of organizations using FortiSOAR for security automation and threat response workflows.
RemediationAI
Upgrade to a patched version of Fortinet FortiSOAR released after the vulnerable version ranges identified in the advisory. For PaaS customers, Fortinet will auto-apply patches; on-premise customers should contact Fortinet support or review the security advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-105 for specific patched release versions. As a temporary mitigation, restrict LDAP configuration modification permissions to the absolute minimum number of administrators and monitor account access logs for unauthorized changes to LDAP server settings. Ensure LDAP service account passwords are unique and not reused across other systems, limiting the blast radius if credential compromise occurs.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-257 – Storing Passwords in a Recoverable Format
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today