6.7
Medium
CVE-2026-23708 A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through…
Description
A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:CExploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiSOAR PaaS 7.6 | 7.6.0 → 7.6.3 | No fix stated |
| FortiSOAR PaaS 7.5 | 7.5.0 → 7.5.2 | No fix stated |
| FortiSOAR on-premise 7.6 | 7.6.0 → 7.6.3 | No fix stated |
| FortiSOAR on-premise 7.5 | 7.5.0 → 7.5.2 | No fix stated |
Other CVEs of FortiSOAR PaaS
The 11 CVEs of FortiSOAR PaaS →
CVE-2026-84385
A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through…
4.9
Medium
CVE-2026-22573
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR…
6.2
Medium
CVE-2025-59809
A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR…
4.1
Medium
CVE-2026-21742
A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3,…
5.4
Medium