Description
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
References (1)
Scores
CVSS v3
4.3
EPSS
0.0004
EPSS Percentile
12.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-257
Status
published
Products (8)
Fortinet/FortiSOAR on-premise
7.3.0 - 7.3.3
Fortinet/FortiSOAR on-premise
7.4.0 - 7.4.5
Fortinet/FortiSOAR on-premise
7.5.0 - 7.5.2
Fortinet/FortiSOAR on-premise
7.6.0 - 7.6.4
Fortinet/FortiSOAR PaaS
7.3.0 - 7.3.3
Fortinet/FortiSOAR PaaS
7.4.0 - 7.4.5
Fortinet/FortiSOAR PaaS
7.5.0 - 7.5.2
Fortinet/FortiSOAR PaaS
7.6.0 - 7.6.4
Published
Apr 14, 2026
Tracked Since
Apr 14, 2026