VIR Vulnerability Intelligence Relay

CVE-2026-22574

medium
Published 2026-04-14 · Modified 2026-05-06
CVSS v3
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2
—
VIR risk
6.5

Description

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration.

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@fortinet.com — https://fortiguard.fortinet.com/psirt/FG-IR-26-105

Application impact
VendorProductVersionsFixed
fortinetfortisoar{"startIncluding":"7.3.0","endExcluding":"7.5.3"}7.5.3

References

CWEs

CWE-257 CWE-522

Verify integrity in audit chain (admin only). AS-IS.