CVE-2026-22574

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-105	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortisoar::::::::
	cpe:2.3:a:fortinet:fortisoar::::::::

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de almacenamiento de contraseñas en formato recuperable en Fortinet FortiSOAR PaaS 7.6.0 hasta 7.6.4, FortiSOAR PaaS 7.5.0 hasta 7.5.2, FortiSOAR PaaS 7.4 todas las versiones, FortiSOAR PaaS 7.3 todas las versiones, FortiSOAR local 7.6.0 hasta 7.6.4, FortiSOAR local 7.5.0 hasta 7.5.2, FortiSOAR local 7.4 todas las versiones, FortiSOAR local 7.3 todas las versiones puede permitir a un atacante remoto autenticado recuperar la contraseña de la cuenta de servicio mediante la modificación de la dirección del servidor en la configuración LDAP.

Information

Published : 2026-04-14 16:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-22574

Mitre link : CVE-2026-22574

CVE.ORG link : CVE-2026-22574

JSON object : View

Products Affected

fortinet

fortisoar

CWE

CWE-257

Storing Passwords in a Recoverable Format

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-22574", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22574", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T16:35:22.098427Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortisoarpaas:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSOAR PaaS", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.4"}, {"status": "affected", "version": "7.5.0", "versionType": "semver", "lessThanOrEqual": "7.5.2"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.5"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.3"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:fortinet:fortisoaron-premise:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoaron-premise:7.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSOAR on-premise", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.4"}, {"status": "affected", "version": "7.5.0", "versionType": "semver", "lessThanOrEqual": "7.5.2"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.5"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-14T16:16:36.760", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-105", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-257"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration."}, {"lang": "es", "value": "Una vulnerabilidad de almacenamiento de contrase\u00f1as en formato recuperable en Fortinet FortiSOAR PaaS 7.6.0 hasta 7.6.4, FortiSOAR PaaS 7.5.0 hasta 7.5.2, FortiSOAR PaaS 7.4 todas las versiones, FortiSOAR PaaS 7.3 todas las versiones, FortiSOAR local 7.6.0 hasta 7.6.4, FortiSOAR local 7.5.0 hasta 7.5.2, FortiSOAR local 7.4 todas las versiones, FortiSOAR local 7.3 todas las versiones puede permitir a un atacante remoto autenticado recuperar la contrase\u00f1a de la cuenta de servicio mediante la modificaci\u00f3n de la direcci\u00f3n del servidor en la configuraci\u00f3n LDAP."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD42D7DF-B095-44E1-B7E1-D203678DF740", "versionEndExcluding": "7.5.3", "versionStartIncluding": "7.3.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E1DFBC-0D1B-419C-89A5-D2A59B7485F6", "versionEndExcluding": "7.6.5", "versionStartIncluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}