Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-22155: FortiSOAR PaaS and On-Premise Leaks Sensitive Info in Transit
CVE-2026-22155 · published 6 months ago
Summary
FortiSOAR software versions 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, and 7.4, as well as on-premise versions 7.6.0 through 7.6.2 and 7.5.0 through 7.5.1, may allow attackers to intercept and read sensitive information being transmitted between the software and users. This could potentially expose confidential data. Update your software to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortisoar paas | <= 7.6.3 |
| fortinet | fortisoar on-premise | <= 7.6.2 |
| fortinet | fortisoar |
>= 7.3.0, < 7.5.3 >= 7.6.0, < 7.6.4 cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:* |
Original advisory text
A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7...
A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to information disclosure via <insert attack vector here>
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published14 Apr 2026
Updated26 Oct 2026
First seen14 Apr 2026
Track software like this
Free during beta