Fortisoar Paas EUVD-2026-22325

CVSS 4.3 with network attack vector, low complexity, and low privileges required (PR:L) indicates a moderately low confidentiality impact with no integrity or availability impact. The EPSS probability is not provided in input data, but the low CVSS score combined with the requirement for authenticated access limits real-world risk. However, the vulnerability is operationally significant in environments where FortiSOAR is trusted to manage connector credentials securely. An insider threat or compromised low-privileged account (help desk, junior analyst) could extract credentials for downstream systems, potentially leading to lateral movement or unauthorized access to monitored tools. The attack is deterministic (AC:L) and requires no user interaction (UI:N), making it reliable for an attacker with valid credentials. This is not a critical vulnerability by severity metrics but represents a privilege escalation path from authenticated-user access to credential compromise across integrated systems.

An authenticated FortiSOAR analyst with connector management permissions (or a compromised account) logs into the FortiSOAR console and navigates to an existing connector's configuration page (e.g., a Splunk or ServiceNow connector that stores an API key or password). The attacker modifies the server address field and saves the change, triggering the platform to re-encrypt or re-encode the stored credential. The attacker then retrieves the modified connector configuration via the API or UI, obtaining the plaintext or weakly protected password. This credential is then used to directly access the downstream system, bypassing FortiSOAR's orchestration controls.