Fortinet Fortisoar vulnerabilities

31 CVEs affecting Fortinet Fortisoar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-23708, published 2026-04-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29061, published 2022-09-09. High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute…
CVE-2022-23443, published 2022-05-04. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.
CVE-2023-27995, published 2023-04-11. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via…
CVE-2023-25605, published 2023-03-07. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests.
CVE-2022-35847, published 2022-09-06. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote…
CVE-2023-23775, published 2024-06-11. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute…
CVE-2024-21760, published 2025-03-18. High severity, CVSS 8.4. EPSS: 0.8% chance of exploitation in the next 30 days. An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all…
CVE-2022-29062, published 2022-09-06. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted…
CVE-2024-36510, published 2025-01-14. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all…
CVE-2023-26211, published 2024-08-13. Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web…

Latest

CVE-2026-23708, published 2026-04-14. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0…
CVE-2026-22576, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all…
CVE-2026-22574, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all…
CVE-2026-22573, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all…
CVE-2026-22155, published 2026-04-14. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3…
CVE-2026-22154, published 2026-04-14. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR…
CVE-2026-21742, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3…
CVE-2025-59809, published 2026-04-14. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4…
CVE-2025-59810, published 2025-12-09. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions,…
CVE-2025-59808, published 2025-12-09. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS…