Description
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
Published: 2026-04-14
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to FortiSOAR on-premise version 7.6.5 or above Upgrade to upcoming FortiSOAR on-premise version 7.5.3 or above Upgrade to FortiSOAR PaaS version 7.6.5 or above Upgrade to upcoming FortiSOAR PaaS version 7.5.3 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 06 May 2026 18:45:00 +0000

Type Values Removed Values Added
Title FortiSOAR Connector Passwords Stored in Recoverable Format

Wed, 06 May 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet fortisoar
Weaknesses CWE-522
CPEs cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*
Vendors & Products Fortinet fortisoar

Wed, 15 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
Title FortiSOAR Connector Passwords Stored in Recoverable Format

Tue, 14 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 16:00:00 +0000

Type Values Removed Values Added
Description A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.
First Time appeared Fortinet
Fortinet fortisoaron-premise
Fortinet fortisoarpaas
Weaknesses CWE-257
CPEs cpe:2.3:a:fortinet:fortisoaron-premise:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.5.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoaron-premise:7.6.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoarpaas:7.6.4:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortisoaron-premise
Fortinet fortisoarpaas
References
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

Subscriptions

Fortinet Fortisoar Fortisoaron-premise Fortisoarpaas
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-04-14T16:46:17.327Z

Reserved: 2026-01-07T18:30:44.883Z

Link: CVE-2026-22576

cve-icon Vulnrichment

Updated: 2026-04-14T16:37:34.812Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-14T16:16:36.937

Modified: 2026-05-06T15:50:36.257

Link: CVE-2026-22576

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-06T18:30:09Z

Weaknesses