4.9
Medium
CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through…
Description
A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here>
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:CExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiSOAR on-premise 7.6 | 7.6.0 → 7.6.6 | No fix stated |
| FortiSOAR on-premise 7.5 | 7.5.0 → 7.5.3 | No fix stated |
| FortiSOAR on-premise 7.4 | 7.4.0 → 7.4.5 | No fix stated |
| FortiSOAR on-premise 7.3 | 7.3.0 → 7.3.3 | No fix stated |
| FortiSOAR PaaS 7.6 | 7.6.0 → 7.6.6 | No fix stated |
| FortiSOAR PaaS 7.5 | 7.5.0 → 7.5.3 | No fix stated |
| FortiSOAR PaaS 7.4 | 7.4.0 → 7.4.5 | No fix stated |
| FortiSOAR PaaS 7.3 | 7.3.0 → 7.3.3 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiSOAR on-premise
The 13 CVEs of FortiSOAR on-premise →
CVE-2026-22573
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR…
6.2
Medium
CVE-2026-23708
A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through…
6.7
Medium
CVE-2025-59809
A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR…
4.1
Medium
CVE-2026-22155
A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3,…
6.2
Medium